A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A stack-based buffer overflow vulnerability has been identified in UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The vulnerability exists in the strcpy function within the /goform/aspRemoteApConfTempSend endpoint of the HTTP Request Handler component. An attacker can exploit this by manipulating the 'Profile' argument to trigger the buffer overflow. The attack can be carried out remotely without physical access to the device. A public exploit is already available, increasing the risk of active exploitation. This type of vulnerability in networking hardware can lead to arbitrary code execution or device compromise. The issue has been documented in NVD, VulDB, and a public GitHub proof-of-concept repository.