The vulnerability CVE-2026-18897 exists in UTT HiPER 1250GW up to version 3.2.7-210907-180535. It is caused by improper handling of the tempName argument in the strcpy function of the /goform/getOneApConfTempEntry file, leading to a stack-based buffer overflow. This flaw can be exploited remotely without user interaction or privileges, as indicated by the CVSS vector. The vendor has not provided any response or patch, and the exploit code is publicly accessible.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. The CVSS score of 8.7 reflects high impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality, integrity, and availability impacts are all high.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is released, consider limiting network exposure of the affected device and applying network-level protections to restrict access to the vulnerable function if possible.