A critical buffer overflow vulnerability in UTT HiPER 1200GW routers poses a severe risk of system compromise or service disruption to affected network infrastructure.

This vulnerability is a buffer overflow (CWE-120) located in the strcpy function within the /goform/formRemoteControl file. While the CVSS vector indicates that low privileges are required, the flaw can be triggered remotely by an authenticated user to overwrite memory and cause a denial of service.

Successful exploitation of this vulnerability can lead to a complete denial of service for the affected router, which may result in significant network downtime for organizations relying on this hardware. Given the CVSS score of 8.8, this is a high-severity issue that could also potentially facilitate further malicious activity if the buffer overflow is leveraged for code execution, leading to unauthorized access to internal network traffic or management interfaces.

Immediate Action: As no specific patch version is currently identified, administrators should restrict access to the management interface and contact UTT support for updated firmware versions that address this overflow.

Proactive Monitoring: Monitor system logs for frequent crashes or unexpected reboots of the HiPER 1200GW device, as these may indicate attempted exploitation.

Compensating Controls: Implement strict firewall rules to ensure that the router management interface is not accessible from untrusted networks, and enforce strong authentication to limit the pool of users who could potentially trigger the vulnerable function.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up hosted on GitHub.

Given the high CVSS score and the availability of a public proof-of-concept, this vulnerability represents a credible threat to network availability. Organizations should prioritize isolating the management interfaces of affected UTT routers and maintain vigilance until a formal firmware patch is released by the vendor to remediate the unsafe memory operation.