CVE-2026-11516: UTT HiPER 2610G formNatStaticMap strcpy buffer overflow
A vulnerability was found in UTT HiPER 2610G up to 3.0.0-171107. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBinds results in buffer overflow. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the device supports it, disable the web form /goform/formNatStaticMap or disable web-based static NAT mapping editing so the NatBinds argument is no longer processed.
UTT HiPER 2610G web management (/goform/formNatStaticMap) formNatStaticMap_enabled = false - Compensating control
Use a WAF, reverse proxy, or firewall to block or filter HTTP(S) requests to the URI /goform/formNatStaticMap and/or requests containing the NatBinds parameter to prevent exploitation.
- Compensating control
Restrict access to the device management interfaces (HTTP/HTTPS) to trusted management IP addresses only and block access from untrusted networks (for example, deny WAN/Internet access to the web management interface).
- Compensating control
Isolate the affected UTT HiPER 2610G devices from untrusted network segments (place on a management VLAN or disconnect from networks) until a vendor fix is applied.
- Operational
Monitor vendor advisories for UTT HiPER 2610G and apply any vendor-supplied firmware update or patch addressing the /goform/formNatStaticMap strcpy vulnerability as soon as it is released; follow vendor instructions to verify and install the update.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11516?
CVE-2026-11516 has a medium severity rating of 5.5.
How can I fix CVE-2026-11516?
To mitigate CVE-2026-11516, it is recommended to update UTT HiPER 2610G to the latest version to eliminate the buffer overflow vulnerability.
What type of vulnerability is CVE-2026-11516?
CVE-2026-11516 is classified as a buffer overflow vulnerability.
Which software is affected by CVE-2026-11516?
The vulnerability CVE-2026-11516 affects UTT HiPER 2610G versions up to 3.0.0-171107.
What attack vectors are associated with CVE-2026-11516?
CVE-2026-11516 can be exploited through manipulation of the argument NatBinds in the strcpy function.