SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-76004 2026-08-19

CVE-2026-76004: Stack-Based Buffer Overflow in UTT HiPER 1250GW Routers

"A publicly disclosed stack-based buffer overflow in the UTT HiPER 1250GW's HTTP handler lets a remote, low-privileged attacker corrupt memory via the `pvid` parameter, rated CVSS 3.1 9.9 (CRITICAL)."

A publicly disclosed stack-based buffer overflow in the UTT HiPER 1250GW's HTTP handler lets a remote, low-privileged attacker corrupt memory via the pvid parameter, rated CVSS 3.1 9.9 (CRITICAL).

What Is It

The flaw sits in the strcpy call within /goform/aspApBasicConfigUrcp, part of the device's HTTP Handler component. Attacker-controlled input passed in the pvid argument is copied without bounds checking, producing a stack-based buffer overflow (CWE-119, CWE-121).

The attack is initiated remotely over the network with low attack complexity and no user interaction. It requires low privileges (CVSS 3.1 PR:L / CVSS 2.0 Au:S, single authentication). VulDB assigns a CVSS 4.0 score of 8.6 (HIGH) alongside the 9.9 CVSS 3.1 primary score, with an exploit maturity of PROOF_OF_CONCEPT.

Why It Matters

The exploit has been disclosed publicly and may be used. A proof-of-concept write-up is hosted on GitHub, which meaningfully shortens the window between disclosure and opportunistic exploitation against internet-facing management interfaces.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, scope is CHANGED with complete confidentiality, integrity, and availability impact on both the vulnerable component and downstream systems. CVSS 4.0 likewise marks all subsequent-system impacts as HIGH. For a network edge device, that means full compromise of the router itself and a pivot point into whatever sits behind it.

This CVE does not appear in the CISA KEV catalog based on the supplied data, so there is no confirmed evidence of active in-the-wild exploitation and no associated KEV remediation deadline at this time.

What's Vulnerable

Patch Status

No vendor patch, fixed version, or remediation guidance is present in the supplied CVE record. NVD status is Received (published 2026-08-19), meaning the entry is still awaiting full analysis. Until a fix is published, restricting network reachability of the device's web management interface is the only lever the source material supports.

Sources