The vulnerability CVE-2026-18895 affects UTT HiPER 1250GW version 3.2.7-210907-180535. It is a stack-based buffer overflow caused by improper handling of the cipher argument in the strcpy function located in /goform/APSecurity_5g. This allows remote attackers with low privileges to execute code or cause denial of service by sending crafted input. The vulnerability has a CVSS 4.0 score of 8.7, indicating high impact on confidentiality, integrity, and availability. The vendor was notified but has not issued any patch or mitigation guidance. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. The vulnerability requires no user interaction and low privileges, making it easier to exploit remotely. The public availability of exploit code increases the likelihood of attacks.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation, users should consider mitigating exposure by restricting remote access to the affected device, disabling vulnerable services if possible, or replacing the device with a secure alternative. Monitor vendor channels for any future updates or patches.