The UTT HiPER 810G router is vulnerable to a remote buffer overflow attack that could lead to unauthorized code execution or system instability.

This is a buffer overflow vulnerability (CWE-120) located in the strcpy function within the /goform/formFireWall file. The vulnerability is reachable via the GroupName parameter in the management interface and requires low privileges (authenticated) to trigger remotely.

The exploitation of this flaw poses a severe risk to organizational network integrity. Because the vulnerability allows for memory corruption within the management interface, an attacker could potentially gain unauthorized control over the device, leading to full system compromise or a denial of service condition. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate further lateral movement into internal segments.

Immediate Action: As no vendor patch is currently available, immediately restrict access to the management interface by limiting source IP addresses to trusted administrative workstations.

Proactive Monitoring: Monitor network traffic for unusual payloads directed at the /goform/formFireWall endpoint and audit system logs for unexpected reboots or service crashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and block malicious input within the GroupName parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher write-up documented in the GitHub issue linked in the CVE references.

Organizations utilizing UTT HiPER 810G devices should treat this vulnerability with high priority despite the lack of a vendor-provided patch. Restricting access to the administrative interface is essential to mitigate the risk of remote exploitation. Security teams should maintain heightened vigilance and prepare to transition to alternative hardware if the vendor fails to provide a security update.