A publicly disclosed stack-based buffer overflow in the UTT HiPER 1200GW router allows a remote, low-privileged attacker to corrupt memory via the timestart parameter, carrying a CVSS 3.1 score of 9.9 (CRITICAL).
What Is It
The flaw lives in the strcpy call reached through /goform/formGroupConfig on the UTT HiPER 1200GW. An attacker who manipulates the timestart argument can overflow a stack buffer. NVD tracks the weakness as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-121 (stack-based buffer overflow), with the record supplied by VulDB as the CNA.
The attack is performed over the network with low complexity, requires only low privileges, and needs no user interaction. CVSS 3.1 scores it 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), with a changed scope reflecting impact beyond the vulnerable component. The CVSS 4.0 secondary metric rates it 8.6 HIGH and marks exploit maturity as PROOF_OF_CONCEPT.
Why It Matters
The exploit has been made public and, per the NVD description, could be used for attacks. That lowers the research barrier; a public writeup is available on GitHub, though the supplied data characterizes the available material as proof-of-concept rather than a confirmed working exploit. Under CVSS 3.1 the confidentiality, integrity, and availability impacts are each rated HIGH, meaning a successful overflow puts substantial control of the device in play.
There is no CISA KEV entry for CVE-2026-76003 in the supplied data, so active in-the-wild exploitation is not confirmed at this time. Edge routers remain attractive targets regardless: they sit at the network boundary and a compromised one is a durable foothold.
What's Vulnerable
- Vendor: UTT
- Product: HiPER 1200GW
- Affected versions: up to and including 2.5.3-170306
- Affected component:
strcpyin/goform/formGroupConfig, reached via thetimestartargument
Patch Status
The supplied NVD record lists no patch, fixed version, or vendor advisory. The CVE was published 2026-08-19 and carries a vulnerability status of "Received," meaning NVD analysis is not yet complete. No CISA KEV required action or remediation deadline applies, as the CVE is not present in the KEV catalog data provided.