CVE-2026-2935
Remote Buffer Overflow in UTT HiPER 810G strcpy Function
Publication date: 2026-02-22
Last updated on: 2026-02-24
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 810g_firmware | to 1.7.7-171114 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2935 is a buffer overflow vulnerability found in the UTT HiPER 810G router firmware versions up to 1.7.7-171114. It occurs in the function strcpy within the /goform/ConfigExceptMSN interface when the "remark" argument is manipulated with input that exceeds the buffer size. This happens because strcpy does not perform any input length validation, allowing an attacker to overflow the buffer.'}, {'type': 'paragraph', 'content': "The vulnerability requires the attacker to be authenticated and can be exploited remotely by sending specially crafted parameters to the router's interface. Exploitation can cause denial of service (DoS) by destabilizing or crashing the device, and under certain conditions, it may lead to further exploitation risks affecting device stability and network security."}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated remote attacker to cause a denial of service (DoS) condition on the UTT HiPER 810G router. The buffer overflow can destabilize or crash the device, leading to loss of availability.
Additionally, the vulnerability affects the confidentiality, integrity, and availability of the device, potentially exposing the network to further security risks if exploited beyond causing DoS.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for abnormal behavior or crashes of the UTT HiPER 810G router, especially when the /goform/ConfigExceptMSN interface is accessed with unusually large or crafted "remark" parameters.'}, {'type': 'paragraph', 'content': 'Detection can involve sending crafted HTTP POST requests to the /goform/ConfigExceptMSN endpoint with large "remark" values to test if the device crashes or behaves abnormally, indicating the presence of the buffer overflow.'}, {'type': 'paragraph', 'content': 'A sample command using curl to test the vulnerability could be:'}, {'type': 'list_item', 'content': 'curl -X POST http://<router-ip>/goform/ConfigExceptMSN -d "Action=modify&remark=$(python3 -c \'print("A"*1000)\')"'}, {'type': 'paragraph', 'content': 'Monitoring network logs for repeated POST requests to /goform/ConfigExceptMSN with large payloads or unusual parameters can also help detect exploitation attempts.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include avoiding the use of the vulnerable firmware version of the UTT HiPER 810G device and restricting access to the /goform/ConfigExceptMSN interface to trusted and authenticated users only.'}, {'type': 'paragraph', 'content': 'It is recommended to upgrade the device firmware to the latest version provided by the vendor that addresses this vulnerability.'}, {'type': 'paragraph', 'content': 'If upgrading is not immediately possible, implement network-level controls such as firewall rules to block or limit access to the vulnerable endpoint.'}, {'type': 'paragraph', 'content': 'From a development perspective, the vulnerability can be mitigated by applying strict length validation on the "remark" parameter and replacing unsafe functions like strcpy with safer alternatives such as strncpy or snprintf.'}, {'type': 'paragraph', 'content': 'Centralized input validation at the firmware level is also advised to prevent buffer overflow conditions.'}] [3, 2]