A buffer overflow vulnerability in UTT HiPER 810G routers poses a significant risk of remote code execution and service disruption to authenticated users.

This flaw exists within the strcpy function of the /goform/formP2PLimitConfig file, where improper handling of the except argument leads to a stack-based buffer overflow. The vulnerability requires the attacker to be authenticated with administrative privileges, as evidenced by the requirement for Digest authentication in the documented proof-of-concept.

Successful exploitation of this vulnerability can lead to full system compromise or a persistent denial of service, rendering network infrastructure unavailable. Given the CVSS score of 8.8, this represents a high-severity threat that could disrupt critical business operations and facilitate unauthorized control over network traffic.

Immediate Action: Contact UTT support or monitor the vendor website for a firmware update that addresses the memory corruption issue in the P2P limit configuration module.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the /goform/formP2PLimitConfig endpoint, specifically looking for unusually large payloads in the except parameter.

Compensating Controls: Implement strict access control lists on the management interface to ensure only authorized administrators can reach the web administration console, thereby limiting the exposure of vulnerable endpoints.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher write-up published on GitHub.

Due to the severity of this vulnerability and the availability of a public proof-of-concept, administrators must prioritize restricting access to the router management interface. While awaiting a vendor-supplied patch, ensure that the device is not exposed to the public internet and that administrative credentials are robust to prevent unauthorized access to the vulnerable function.