CVE-2026-76004 is a stack-based buffer overflow vulnerability in the UTT HiPER 1250GW device firmware up to version 3.2.7-210907-180535. The vulnerability arises from unsafe use of the strcpy function in the /goform/aspApBasicConfigUrcp HTTP handler when processing the 'pvid' argument. An attacker with network access and low privileges can remotely trigger this overflow, potentially leading to arbitrary code execution or denial of service. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. Public exploit details have been disclosed, but no confirmed exploitation in the wild is reported. No patch or official fix has been documented in the provided data.

Successful exploitation allows remote attackers to cause a stack-based buffer overflow, which can lead to arbitrary code execution, full system compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability with high severity. Since the attack can be initiated remotely with low privileges and no user interaction, the risk is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity related to the /goform/aspApBasicConfigUrcp endpoint. Avoid exposing the device to untrusted networks.