Remote Stack-Based Buffer Overflow in UTT HiPER 1200GW

A security flaw (CVE-2026-18898) has been identified in UTT HiPER 1200GW routers running firmware up to v2.5.3-170306. The vulnerability resides in the strcpy implementation within the /goform/ConfigAdvideo web handler. An attacker can trigger a stack-based buffer overflow by sending a specially crafted HTTP request containing an oversized timestart argument. Because this endpoint is reachable remotely, it facilitates unauthenticated or low-privilege exploitation. Public exploit code for this vulnerability is currently available on GitHub. Given that the vendor has not released a patch or official response, these devices remain at high risk of compromise. Defenders should prioritize isolating affected network hardware or restricting access to administrative interfaces.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed UTT HiPER 1200GW web administrative interfaces.
2. Attacker crafts a malicious HTTP GET or POST request targeting the /goform/ConfigAdvideo URI.
3. Attacker injects a payload of excessive length into the timestart parameter of the request.
4. The web service receives the request and passes the timestart value to the vulnerable strcpy function.
5. The strcpy function fails to validate the input length, resulting in a buffer overflow on the process stack.
6. The overflow overwrites the return pointer on the stack with the attacker-controlled payload address.
7. The process executes the attacker's shellcode upon returning from the function call.
8. Final objective achieved: unauthorized remote code execution on the router, facilitating persistence or further network pivoting.

Impact

Successful exploitation allows remote attackers to gain full code execution on the vulnerable router. This could lead to a complete compromise of the network perimeter, enabling the attacker to perform traffic interception, internal network reconnaissance, and persistence within the environment. Public availability of exploit code significantly increases the likelihood of opportunistic attacks targeting this hardware.

Recommendation

• Immediately restrict network access to the web-based administrative interface of UTT HiPER 1200GW routers to trusted management subnets.
• Monitor network traffic for HTTP requests targeting the URI /goform/ConfigAdvideo with exceptionally long timestart arguments.
• If firmware updates remain unavailable, consider replacing affected hardware that sits at the network edge.
• Block inbound traffic attempting to reach administrative endpoints on the HiPER 1200GW devices from the public internet.