CVE-2026-11517: UTT HiPER 2610G formConfigDnsFilterGlobal strcpy buffer overflow

Synopsis

A stack-based buffer overflow exists in the UTT HiPER 2610G router firmware, affecting the formConfigDnsFilterGlobal form handler up to version 3.0.0-171107. The vulnerability is reachable over the network by a low-privilege authenticated user who can manipulate the GroupName argument to overflow a fixed-size buffer via an unsafe strcpy call. Successful exploitation gives an attacker full read and write access to device memory and can crash or take over the affected device. No fix has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable form handler is exposed over the network, so an attacker must be able to reach the device's web management interface across the network to send the malformed GroupName argument.

• AuthenticationRequired

  The attack requires a low-privilege authenticated session on the device; any account with access to the DNS filter configuration form is sufficient.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends the crafted request directly to the form handler without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the overflow is reliably triggered without requiring specific race conditions, memory layout luck, or other variable environmental factors.

Blast Radius

• An attacker can read arbitrary memory from the device, exposing credentials, session tokens, and configuration data stored in the router's process space.
• An attacker can overwrite memory contents, modifying routing tables, DNS filter rules, or other persisted configuration on the device.
• The overflow can crash the affected form handler process or the broader router firmware, taking down network connectivity for all devices behind the HiPER 2610G.
• A working exploit gives the attacker the ability to execute arbitrary code on the device with the privileges of the web server process, enabling full device compromise.