提交 #865277: UTT HiPER 1200GW <=v2.5.3-170306 Buffer Overflow

A serious buffer overflow vulnerability has been identified in the UTT Aggressive HiPER 1200GW router. The vulnerable endpoint is /goform/pptpSrvGlobalConfig, where insufficient validation of user-supplied input allows an attacker to trigger a stack-based buffer overflow.

By sending a specially crafted HTTP request to /goform/pptpSrvGlobalConfig containing an oversized value for a vulnerable parameter, an attacker can cause data to be written beyond the bounds of a fixed-size stack buffer. The root cause lies in the unsafe use of the strcpy function at strcpy((char *)(v38 + 48), src_2);. In this code, the destination is a buffer located 48 bytes into a stack-allocated structure referenced by v38, while the source string src_2 is populated directly from attacker-controlled input without any length checking. When the supplied input exceeds the allocated buffer capacity, the strcpy operation overwrites adjacent stack memory, potentially corrupting critical control data such as saved return addresses and frame pointers.

• 来源: ⚠️ https://github.com/7wkajk/CVE-VUL/blob/main/104.md
• 用户: yecp (UID 95483)
• 提交: 2026-06-22 11時42分 (2 月前)
• 管理: 2026-08-08 13時33分 (2 months later)
• 状态: 已接受
• VulDB条目: 387177 [UTT HiPER 1200GW 直到 2.5.3-170306 pptpSrvGlobalConfig strcpy EncryptionMode 内存损坏]
• 积分: 20