CVE-2026-76004 in HiPER 1250GW
Summary
by MITRE • 08/19/2026
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The UTT HiPER 1250GW, specifically firmware versions up through 3.2.7-210907-180535, contains a critical security flaw within its embedded web server implementation that allows for remote code execution via stack-based buffer overflow. This vulnerability is located in the HTTP handler component, which processes incoming requests to configure device settings. The specific point of failure resides in the file /goform/aspApBasicConfigUrcp, where the C standard library function strcpy is employed without adequate bounds checking. When a user submits configuration data via the web interface or API, the application copies input into a fixed-size buffer on the stack using this unsafe string copying mechanism. Because there are no length validations performed before the copy operation, an attacker can supply a payload that exceeds the allocated memory space of the destination buffer.
The technical nature of this flaw is classified as CWE-120, Buffer Copy without Checking Size of Input, which directly leads to CWE-121, Stack-based Buffer Overflow. By carefully crafting the pvid argument sent in an HTTP request, a malicious actor can overwrite adjacent memory locations on the stack, including critical control data such as the return address and saved frame pointer. This overwriting allows the attacker to redirect the program flow to arbitrary code injected into the buffer or present elsewhere in memory. Since this functionality is exposed through the web management interface of the router, the vulnerability is remotely exploitable without requiring prior authentication on many default configurations, although some implementations may require valid credentials for administrative access. The presence of a publicly disclosed exploit significantly lowers the barrier to entry for attackers, enabling automated scanning and exploitation campaigns targeting vulnerable devices across various networks.
The operational impact of this vulnerability is severe, potentially resulting in complete compromise of the network infrastructure hosting or connected to the affected device. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server process, which often runs as root on embedded Linux systems. This can lead to unauthorized access to sensitive data stored locally on the router, such as Wi-Fi passwords and ISP credentials. Furthermore, a compromised gateway serves as an ideal pivot point for lateral movement within the local network, allowing attackers to target other devices like computers, IoT gadgets, or servers that are otherwise protected by perimeter firewalls. The device may also be recruited into botnets used for distributed denial-of-service attacks or cryptomining operations, degrading performance and increasing energy consumption while exposing users to further security risks.
Mitigation strategies must prioritize immediate patching of the firmware to a version where this vulnerability has been remediated. If an updated firmware is not immediately available, administrators should restrict access to the web management interface by disabling remote administration features or limiting HTTP/HTTPS access to trusted IP addresses only. Implementing network segmentation can also help contain potential damage if exploitation occurs, ensuring that compromised devices cannot easily communicate with critical internal assets. Additionally, deploying intrusion detection systems configured to detect stack-based overflow patterns in HTTP traffic may provide an additional layer of defense against active exploits targeting this specific flaw. Long-term remediation involves enforcing secure coding practices during development, specifically the replacement of unsafe functions like strcpy with safer alternatives such as strncpy or strlcpy that enforce length limits and prevent buffer overflows from occurring in the first place.