CVE-2026-10293: UTT HiPER 1200GW formFireWall strcpy stack-based overflow

Synopsis

A stack-based buffer overflow exists in the UTT HiPER 1200GW router firmware, affecting all versions up to 2.5.3-170306. The flaw is in the formFireWall form handler, where the Profile argument is copied into a fixed-size stack buffer using strcpy without bounds checking; a low-privileged attacker can reach it over the network. Successful exploitation gives the attacker full control over the device, including the ability to read, modify, or disrupt all traffic flowing through it. No upstream fix has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable formFireWall endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the device's management interface.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account on the device is sufficient to reach the vulnerable code path.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no action from a logged-in user or administrator is needed to trigger the overflow.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the overflow is reliably triggerable without needing to meet race conditions or specific memory layout requirements.

Blast Radius

• The attacker gains full read access to data processed by the device, including credentials, session tokens, and cleartext traffic passing through the router.
• The attacker can modify firewall rules and routing configuration, redirecting or intercepting traffic flows.
• The attacker can crash the device or render it unresponsive, disrupting all network connectivity for hosts behind the gateway.
• Because the overflow targets kernel or privileged firmware code on a network edge device, post-exploitation persistence is achievable with no further authentication.