A critical buffer overflow vulnerability exists in UTT 1200GW and 1250GW routers that may allow remote attackers to cause a denial of service or potentially execute arbitrary code.

The vulnerability is a buffer overflow (CWE-120) triggered by an unsafe call to the strcpy function within the /goform/formApMail endpoint. While the CVSS vector indicates a requirement for low privileges (PR:L), the vulnerability is reachable remotely and represents a significant risk to device stability.

The ability to trigger a buffer overflow allows an authenticated attacker to crash the router, resulting in a denial of service for all dependent network traffic. Given the critical nature of edge routing equipment, such an outage could lead to significant operational downtime and loss of connectivity for the organization. With a CVSS score of 8.8, this vulnerability is considered High severity, especially if the device manages sensitive internal network segments.

Immediate Action: As there is currently no vendor-provided patch, administrators should restrict network access to the management interface of affected UTT routers to trusted IP addresses only. If possible, disable the exposed web-based management features until the vendor releases a firmware update.

Proactive Monitoring: Monitor system logs for repeated crash events or unauthorized attempts to access the /goform/formApMail endpoint. Alerting should be configured for any unusual spikes in administrative authentication failures or recurring device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect incoming traffic for unusually long strings directed at the senderEmail parameter. This can effectively filter malicious payloads before they reach the vulnerable service.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the technical write-up provided by the researcher.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses a credible risk to network infrastructure. Organizations utilizing UTT 1200GW or 1250GW devices must prioritize isolating these management interfaces from the public internet and monitoring for signs of exploitation. Administrative teams should continue to check the official UTT support portal for firmware updates and apply them immediately once available.