CVE-2026-2980
Remote Buffer Overflow in UTT HiPER 810G setSysAdm Function
Publication date: 2026-02-23
Last updated on: 2026-02-24
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 810g_firmware | to 1.7.7-171114 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2980 is a critical buffer overflow vulnerability found in the UTT HiPER 810G router, specifically in the strcpy function within the /goform/setSysAdm endpoint. The vulnerability arises because the argument passwd1 is copied into a buffer without verifying that the input size fits, leading to a buffer overflow.
This improper handling of input data allows an attacker to overwrite memory buffers remotely, potentially causing denial of service (DoS) or other malicious impacts.
How can this vulnerability impact me? :
The vulnerability can impact the confidentiality, integrity, and availability of the affected device.
- An attacker can remotely exploit the buffer overflow to cause denial of service (DoS) conditions.
- It may allow attackers to execute arbitrary code or disrupt normal device operations.
- Successful exploitation requires authentication, but no physical or local access is needed.
No official patches or mitigations have been published, so affected devices should be replaced or otherwise protected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability affects the UTT HiPER 810G device firmware up to version 1.7.7-1711, specifically the /goform/setSysAdm endpoint where the passwd1 argument is used. Detection would involve monitoring or testing this endpoint for buffer overflow attempts.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is triggered remotely via the passwd1 parameter, network detection could involve inspecting HTTP requests to the /goform/setSysAdm path for unusually long or malformed passwd1 values that could cause buffer overflow.'}, {'type': 'paragraph', 'content': 'No specific detection commands or signatures are provided in the available resources. However, you could use network traffic analysis tools like tcpdump or Wireshark to capture HTTP POST requests to /goform/setSysAdm and look for suspicious payloads.'}, {'type': 'list_item', 'content': "Example command to capture traffic to the vulnerable endpoint: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/setSysAdm'"}, {'type': 'list_item', 'content': "Use curl or similar tools to test the endpoint with controlled inputs to see if the device behaves unexpectedly: curl -X POST http://<device-ip>/goform/setSysAdm -d 'passwd1=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'"}, {'type': 'paragraph', 'content': 'Because exploitation requires authentication, detection might also involve reviewing authentication logs or attempts to access this endpoint with suspicious parameters.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
There are no known official patches or fixes provided by the vendor for this vulnerability.
Immediate mitigation steps include restricting remote access to the affected device, especially to the /goform/setSysAdm endpoint, to trusted networks or IP addresses only.
If possible, disable remote management features or restrict administrative access to the device to prevent exploitation.
Monitor the device for suspicious activity or exploitation attempts targeting the passwd1 parameter.
Consider replacing the affected UTT HiPER 810G device with an alternative product that is not vulnerable.