CVE-2026-78170: UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the reported severity vector indicates that low-level privileges are required. No user interaction is required.
Which systems should be considered affected?
UTT HiPER 1200GW devices running versions up to and including 2.5.3-170306 are reported as affected.
How can defenders identify possible exploitation attempts?
Review requests targeting /goform/formConfigFastDirectionW, particularly those supplying a manipulated ssid argument. The issue is triggered through the strcpy operation handling that argument.
Is public exploit code available?
Yes. The exploit has been published and may be used, increasing the likelihood of attempted exploitation.