CVE-2026-5566
Buffer Overflow in UTT HiPER 1250GW /goform/formNatStaticMap Allows Remote Exploitation
Publication date: 2026-04-05
Last updated on: 2026-04-05
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | hiper_1250gw | to 3.2.7-210907-180535 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5566 is a critical buffer overflow vulnerability found in the UTT HiPER 1250GW router firmware up to version 3.2.7-210907-180535. It occurs in the /goform/formNatStaticMap interface when an attacker sends a specially crafted HTTP POST request with the parameter Action set to any value other than "add" and provides an excessively long string in the NatBind parameter.
The vulnerability arises because the firmware uses the unsafe C function strcpy to copy the NatBind parameter without checking its length, leading to a buffer overflow that overwrites adjacent memory.
This can cause the device's web management service to crash, make the management interface inaccessible, or cause device reboots and other abnormal behaviors.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to denial of service (DoS) conditions on the affected device.
- Crashes of the web management service.
- Inaccessibility of the device's management interface.
- Unexpected device reboots or other abnormal behaviors.
Since the exploit is publicly available, attackers can remotely exploit this vulnerability without user interaction, potentially disrupting network operations or device management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the vulnerable device's `/goform/formNatStaticMap` interface with the `Action` parameter set to a value other than "add" and an excessively long string in the `NatBind` parameter.
A proof-of-concept detection involves sending a POST request with `Action=del` and a long string of characters in `NatBind`. If the device becomes unresponsive or its management interface becomes inaccessible, it indicates the presence of the vulnerability.
- Use a command-line tool like curl to send the test POST request:
- curl -X POST http://<device-ip>/goform/formNatStaticMap -d "Action=del&NatBind=$(python3 -c 'print("a"*1000)')"
If the device crashes, reboots, or the management interface becomes inaccessible after this request, it confirms the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable `/goform/formNatStaticMap` interface to trusted networks only, such as by using firewall rules or network segmentation.
Avoid sending any requests with the `Action` parameter set to values other than "add" to the device until a firmware update is applied.
If possible, disable remote management features or restrict management access to local or secure environments.
Monitor the device for abnormal behavior such as crashes, reboots, or loss of management interface accessibility, which may indicate exploitation attempts.
Long term, update the device firmware to a version that replaces unsafe functions like `strcpy` with safer alternatives and implements input validation and stack protection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in UTT HiPER 1250GW allows remote attackers to cause buffer overflow via the NatBind parameter, potentially leading to denial of service or device instability.
Such security weaknesses can impact compliance with standards like GDPR and HIPAA, which require protection of data integrity, availability, and confidentiality by mandating secure system operation and risk mitigation against unauthorized access or disruption.
If exploited, this vulnerability could lead to service outages or unauthorized control, thereby violating requirements for maintaining secure and reliable systems under these regulations.