High severity · published Mar 26, 2026
CVE-2026-4862
UTT HiPER 1250GW Parameter formConfigDnsFilterGlobal strcpy buffer overflow
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H1
HiPER 1250GW · UTT
3.2.7-210907-180535 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4862
github.com
https://github.com/kirlic123/IOTvulner/blob/main/309-1/5.md
vuldb.com
https://vuldb.com/?ctiid.353193
vuldb.com
https://vuldb.com/?id.353193
vuldb.com
https://vuldb.com/?submit.776230
More from HiPER 1250GW
9.9
CVE-2026-78169
UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow
9.9
CVE-2026-76004
UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow
8.8
CVE-2026-18897
UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow
8.8
CVE-2026-18895
UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow
8.8
CVE-2026-14721
UTT HiPER 1250GW Web Endpoint ConfigWirelessBase_5g stack-based overflow