CVE-2026-9627

UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow

CVSS 8.7 HIGHEPSS 0.5%CWE-119 CWE-120

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.7EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

27 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web Management Interface. The manipulation of the argument sysAdmUser/sysAdmPass results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

UTT · HiPER 1200GW

public PoCs found — 1

cve_referencegithub.com/zhouguobing-maker/cve/blob/main/9.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/zhouguobing-maker/cve/blob/main/9.md https://vuldb.com/submit/818374 https://vuldb.com/vuln/365683 https://vuldb.com/vuln/365683/cti