Submeter #877884: UTT HiPER 1200GW <=v2.5.3-170306 Buffer Overflow

A serious buffer overflow vulnerability has been identified in the UTT Aggressive HiPER 1200GW router. The vulnerable endpoint is /goform/formGroupConfig, where insufficient validation of user-supplied input can be exploited to trigger a stack-based buffer overflow.

By sending a specially crafted HTTP request to /goform/formGroupConfig with an excessively long value for a vulnerable parameter, an attacker can overflow a fixed-size buffer allocated on the stack. The root cause lies in the unsafe use of the strcpy function at the following code location: strcpy((char *)(InstPointByIndex_1 + 84), src_1);. Here, the destination buffer is offset 84 bytes into a stack-allocated structure referenced by InstPointByIndex_1, while the source string src_1 is populated directly from attacker-controlled input without any boundary checks. When the provided input exceeds the capacity of the destination buffer, the strcpy operation writes beyond the buffer boundary, corrupting adjacent stack memory, including critical data such as saved return addresses and frame pointers.

• Fonte: ⚠️ https://github.com/7wkajk/CVE-VUL/blob/main/105.md
• Utilizador: yecp (UID 95483)
• Submissão: 02/07/2026 12h59 (há 2 meses)
• Moderação: 18/08/2026 20h49 (2 months later)
• Estado: Aceite
• Entrada VulDB: 391919 [UTT HiPER 1200GW até 2.5.3-170306 /goform/formGroupConfig strcpy timestart Excesso de tampão]
• Pontos: 20