CVE-2026-31060
Buffer Overflow in UTT Aggressive HiPER 810G Causes DoS
Publication date: 2026-04-06
Last updated on: 2026-04-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 810g_firmware | to 1.7.7-171114 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31060 is a buffer overflow vulnerability in the UTT HiPER 810G router firmware versions up to v3v1.7.7-171114. It occurs in the notes parameter of the formGroupConfig function, where input data is copied using the unsafe strcpy function without proper bounds checking. This allows an attacker to send an excessively long notes parameter in an HTTP POST request, causing memory corruption.
The vulnerability can be exploited by authenticated users via a crafted HTTP POST request to the /goform/formGroupConfig endpoint, potentially leading to denial of service or other exploitations.
How can this vulnerability impact me? :
This vulnerability can be exploited to cause a Denial of Service (DoS) on the affected device by triggering a buffer overflow through a crafted input in the notes parameter. This can lead to memory corruption, potentially crashing the device or disrupting its normal operation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP POST requests to the endpoint `/goform/formGroupConfig` on the UTT HiPER 810G router firmware up to version v3v1.7.7-171114.
Specifically, detection involves identifying POST requests containing an excessively long `notes` parameter, which is used to trigger the buffer overflow.
A practical approach is to capture and analyze HTTP traffic targeting the router, looking for requests with large payloads in the `notes` field.
- Use network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to `/goform/formGroupConfig`.
- Example tcpdump command: `tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/goform/formGroupConfig'`
- Use curl or similar tools to test the endpoint with crafted payloads to verify if the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint `/goform/formGroupConfig` to trusted users only, as exploitation requires authenticated access.
Additionally, monitor and filter incoming HTTP POST requests to detect and block those with unusually large `notes` parameters.
If possible, apply any available firmware updates or patches from the vendor that address this buffer overflow vulnerability.
As a temporary measure, consider disabling or limiting the functionality of the affected API endpoint until a fix is applied.