CVE-2026-78169 is a remote stack-based buffer overflow vulnerability in UTT HiPER 1250GW devices up to version 3.2.7-210907-180535. The issue arises from improper handling of the Profile argument in the strcpy function of the /goform/aspRemoteApConfTempSend HTTP Request Handler. This allows an attacker with network access and low privileges to execute arbitrary code remotely, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-119 and has a CVSS v3.1 score of 9.9, indicating critical impact. Public exploit code is available, but no official patch or remediation has been confirmed.

Successful exploitation can lead to remote code execution with full system compromise, affecting confidentiality, integrity, and availability of the device. Given the high CVSS score and the availability of public exploit code, affected devices are at significant risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially to the HTTP interface handling the vulnerable function. Monitor for unusual activity related to exploitation attempts. Do not rely on generic mitigations unless specifically recommended by the vendor.