A critical buffer overflow vulnerability in UTT HiPER 810G routers enables remote authenticated attackers to achieve memory corruption and potential denial of service.

The flaw resides in the strcpy function within the /goform/formApLbConfig endpoint, which fails to perform bounds checking on the loadBalanceNameOld argument. An authenticated attacker can send a crafted POST request to this endpoint to overflow the destination buffer, leading to memory corruption.

Successful exploitation of this vulnerability allows an attacker to cause a denial of service, rendering the network appliance unresponsive and impacting connectivity for all downstream users. Given the CVSS score of 8.8, this represents a high risk to business continuity. Unauthorized memory manipulation can also potentially lead to arbitrary code execution, posing a severe threat to the integrity and availability of the network infrastructure.

Immediate Action: Contact the vendor or check the official UTT support portal for firmware updates that address this buffer overflow. If no patch is currently available, restrict access to the administrative interface to trusted management IP addresses only.

Proactive Monitoring: Monitor device access logs for unusual POST requests directed at the /goform/formApLbConfig endpoint, specifically looking for abnormally long string payloads in the loadBalanceNameOld parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list to filter and block suspicious traffic directed at router management interfaces.

Public Exploit Available: Yes, a proof of concept is available via the researcher write-up on GitHub.

Organizations utilizing UTT HiPER 810G routers must treat this vulnerability with high priority due to the existence of a public proof of concept and the potential for service disruption. Administrators should prioritize restricting management access and applying manufacturer-provided security patches immediately upon their release to mitigate the risk of remote exploitation.