CVE-2026-4862
UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflow
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 26, 2026
- Updated
- Mar 26, 2026
- Reserved
- Mar 25, 2026
Description
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
HiPER 1250GWUTT |
|
References
- VDB-353193 | UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflowvdb-entrytechnical-description
- VDB-353193 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #776230 | UTT HiPER 1250GW <=v3.2.7-210907-180535 Buffer Overflowthird-party-advisory
- https://github.com/kirlic123/IOTvulner/blob/main/309-1/5.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.