High severity · published Aug 5, 2026
CVE-2026-18897
UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H1
HiPER 1250GW · UTT
v3.2.7-210907-180535 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18897
github.com
https://github.com/7wkajk/CVE-VUL/blob/main/102.md
vuldb.com
https://vuldb.com/cve/CVE-2026-18897
vuldb.com
https://vuldb.com/submit/858617
vuldb.com
https://vuldb.com/vuln/385932
vuldb.com
https://vuldb.com/vuln/385932/cti
More from HiPER 1250GW
9.9
CVE-2026-78169
UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow
9.9
CVE-2026-76004
UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow
8.8
CVE-2026-18895
UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow
8.8
CVE-2026-14721
UTT HiPER 1250GW Web Endpoint ConfigWirelessBase_5g stack-based overflow
8.8
CVE-2026-9632
UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow