CVE-2026-4318
Remote Buffer Overflow in UTT HiPER 810G strcpy Function
Publication date: 2026-03-17
Last updated on: 2026-03-17
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | hiper_810g | to 1.7.7-171114 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4318 is a critical buffer overflow vulnerability in the UTT HiPER 810G router firmware versions up to 1.7.7-171114. It occurs in the function strcpy within the file /goform/formApLbConfig, specifically involving the argument loadBalanceNameOld.
The vulnerability arises because the code copies data from the loadBalanceNameOld parameter into a buffer without proper bounds checking, using unsafe functions like strcpy and strcat. This allows an attacker to overflow the buffer by sending an excessively long string.
The attack can be initiated remotely via an HTTP POST request to the endpoint /goform/formApLbConfig, requiring Digest authentication with administrative credentials.
How can this vulnerability impact me? :
This vulnerability can impact the confidentiality, integrity, and availability of the affected device.
- An attacker can cause a buffer overflow that may lead to denial of service (DoS), crashing the device or disrupting its normal operation.
- Potentially, other malicious effects could be exploited through this overflow, although specific remote code execution is not explicitly confirmed.
The attack complexity is low, and a proof-of-concept exploit is publicly available, increasing the risk of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests to the endpoint `/goform/formApLbConfig` on the UTT HiPER 810G router. Specifically, look for requests where the parameter `loadBalanceNameOld` contains an excessively long string, which is used to trigger the buffer overflow.'}, {'type': 'paragraph', 'content': 'Detection can also involve checking for authentication attempts using Digest authentication with administrative credentials, as the exploit requires such authentication.'}, {'type': 'paragraph', 'content': 'A proof-of-concept exploit involves sending a crafted HTTP POST request with a long `loadBalanceNameOld` parameter. Network monitoring tools or intrusion detection systems (IDS) can be configured to alert on unusually long values in this parameter or on POST requests to this specific endpoint.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability (requires valid admin credentials):'}, {'type': 'list_item', 'content': 'curl -X POST -u admin:password --digest -d "Action=add&loadBalanceNameOld=$(python3 -c \'print("A"*1000)\')" http://<router-ip>/goform/formApLbConfig'}, {'type': 'paragraph', 'content': 'Replace `<router-ip>`, `admin`, and `password` with the appropriate values. This command sends a very long string in the `loadBalanceNameOld` parameter to test for buffer overflow behavior.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Currently, there are no known countermeasures or mitigations available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected UTT HiPER 810G device or firmware version (up to 1.7.7-171114) with a secure alternative that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restrict access to the device's management interface to trusted networks and users only, and monitor for suspicious activity targeting the `/goform/formApLbConfig` endpoint."}] [2]