The vulnerability CVE-2026-18898 affects UTT HiPER 1200GW up to version 2.5.3-170306. It is a stack-based buffer overflow caused by improper handling of the timestart argument in the strcpy function located in /goform/ConfigAdvideo. This allows remote attackers to potentially execute arbitrary code or cause a denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. Although the vendor was contacted, no remediation or patch has been issued. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected devices. The vulnerability requires no user interaction and can be triggered remotely, increasing the attack surface. The availability of public exploit code further elevates the risk. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting network access to the affected device and monitoring for suspicious activity targeting the /goform/ConfigAdvideo endpoint. Applying any future official patches promptly is recommended once available.