A buffer overflow vulnerability in the UTT Jinqi 1200GW router, reachable via the web interface, poses a significant risk of service disruption or potential remote code execution.

The vulnerability exists within the sub_4B48F8 function, which fails to perform bounds checking when processing the loadBalanceNameOld argument during an add action on the /goform/formApLbConfig endpoint. This flaw requires the attacker to be authenticated as a user with sufficient privileges to access the configuration form.

Successful exploitation of this buffer overflow can lead to a denial of service, effectively taking the router offline and disrupting network connectivity for all dependent systems. Given the CVSS score of 8.8, the vulnerability is considered high severity, as memory corruption flaws frequently provide a pathway for an attacker to execute arbitrary code with the privileges of the web service, leading to full device compromise.

Immediate Action: As the vendor has not provided a patch, administrators should restrict access to the management interface to trusted internal networks only. If possible, disable the affected configuration features or the web management interface entirely until a firmware update is released.

Proactive Monitoring: Monitor device logs for repeated or suspicious POST requests to the /goform/formApLbConfig endpoint. Investigate any unexpected device reboots or service instability that may indicate a crash caused by an exploitation attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) or an intrusion detection system to filter traffic containing excessively long strings in the loadBalanceNameOld parameter. Ensure that the router management interface is never exposed to the public internet.

Public Exploit Available: Yes, a public proof of concept has been published in the technical write-up provided by the researchers at Guangzhou University.

Given the lack of a vendor-supplied patch and the availability of a public proof-of-concept, users must prioritize the isolation of the management interface. Organizations using the UTT Jinqi 1200GW should move immediately to restrict administrative access and apply non-vendor mitigations to reduce the attack surface until official firmware updates are made available.