High severity · published Aug 5, 2026
CVE-2026-18898
UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H1
HiPER 1200GW · UTT
v2.5.3-170306 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18898
github.com
https://github.com/7wkajk/CVE-VUL/blob/main/103.md
vuldb.com
https://vuldb.com/cve/CVE-2026-18898
vuldb.com
https://vuldb.com/submit/858620
vuldb.com
https://vuldb.com/vuln/385933
vuldb.com
https://vuldb.com/vuln/385933/cti
More from HiPER 1200GW
9.9
CVE-2026-76003
UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
8.8
CVE-2026-78170
UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
8.8
CVE-2026-19341
UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow
8.8
CVE-2026-10293
UTT HiPER 1200GW formFireWall strcpy stack-based overflow
8.8
CVE-2026-10292
UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow