CVE-2026-76003: UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
UTT HiPER 1200GW devices running version 2.5.3-170306 or earlier are identified as affected. Remote-reachable devices should be prioritized because the attack can be performed remotely.
What access does an attacker need?
The supplied severity vector indicates low privileges are required. Exploitation involves manipulating the timestart argument submitted to /goform/formGroupConfig.
How can I determine whether a device is affected?
Verify whether the device is a UTT HiPER 1200GW and determine its installed version. Versions up to and including 2.5.3-170306 are reported as affected.
How urgent is mitigation?
A public exploit is available, and the issue can result in a stack-based buffer overflow with high confidentiality, integrity, and availability impact. Prioritize limiting remote exposure where possible until affected devices can be remediated.