Description

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T02:17:04.817Z",
  "pubdate": "2026-08-24T02:17:04.817Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the UTT HiPER 1200GW router up to version 2.5.3-170306. The vulnerability resides in the formConfigFastDirectionW binary handling of the ssid parameter. An unauthenticated remote attacker can exploit this flaw by sending a maliciously crafted HTTP request containing an oversized string to the vulnerable endpoint. Successful exploitation of this vulnerability leads to remote code execution, system compromise, and potential denial of service conditions affecting the core routing functionalities. Given that the exploit has been publicly disclosed and is actively available, the risk to exposed devices is critical. Remediation is complicated by the lack of vendor-supplied patches for legacy firmware versions, necessitating strict network segmentation and edge filtering as interim defensive measures.",
  "technicalDetails": "The vulnerability is fundamentally caused by unsafe string handling operations within the firmware architecture of the UTT HiPER 1200GW. Specifically, the vulnerability stems from the use of the legacy, bounds-checking-deficient function strcpy located within the administrative configuration binary associated with the file /goform/formConfigFastDirectionW. During the processing of incoming HTTP POST or GET parameters, the application extracts the value supplied in the ssid argument and copies it directly into a fixed-size local stack buffer without performing adequate length validation or bounds verification.\nBecause strcpy does not verify the size of the source string relative to the destination buffer, an attacker can supply an input string that vastly exceeds the allocated memory space. This condition results in a classic buffer overflow where excess data overflows the stack frame, overwriting adjacent memory regions, including saved frame pointers and return instruction addresses. When the vulnerable function attempts to return execution control, the instruction pointer is redirected to the attacker-controlled memory address specified in the overwritten return pointer.\nThe attack flow proceeds as follows: First, the remote attacker crafts a specialized HTTP request targeting the /goform/formConfigFastDirectionW URI, embedding a payload designed to trigger the strcpy overflow within the ssid parameter. Second, the embedded web server daemon parses the request parameters and passes the oversized ssid string to the vulnerable function without sanitization. Third, the execution of strcpy writes beyond the boundaries of the local buffer, corrupting the call stack. Finally, upon function exit, the hijacked instruction pointer executes arbitrary machine code injected within the payload.\nThe affected component is the firmware binary processing the formConfigFastDirectionW endpoint on UTT HiPER 1200GW devices running versions up to 2.5.3-170306. The vulnerability is accessible over the network without requiring prior authentication or specific user privileges, exposing the device to external adversaries capable of reaching the management interface or web administration panel. Post-exploitation impact includes full system compromise, persistent unauthorized access, manipulation of routing tables, and device destabilization."
}