The vulnerability CVE-2026-11517 affects UTT HiPER 2610G devices running firmware up to version 3.0.0-171107. It arises from a buffer overflow in the strcpy function used in the /goform/formConfigDnsFilterGlobal endpoint when processing the GroupName parameter. This flaw allows remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability requires no privileges or user interaction and has a high impact on confidentiality, integrity, and availability. Although the exploit has been publicly disclosed, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability can lead to a buffer overflow condition, which may allow an attacker to execute arbitrary code remotely or cause a denial of service on affected UTT HiPER 2610G devices. The vulnerability affects confidentiality, integrity, and availability with high impact. No known exploits in the wild have been reported yet, but public disclosure increases the risk of exploitation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting network exposure of affected devices, especially restricting access to the /goform/formConfigDnsFilterGlobal endpoint. Monitor vendor communications closely for updates on patches or mitigations.