The vulnerability CVE-2026-7418 affects UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. It is caused by improper handling of the Profile argument in the strcpy function located in route/goform/NTP, leading to a buffer overflow condition. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known, but no vendor patch or official remediation has been documented.

Successful exploitation of this buffer overflow vulnerability can lead to remote code execution or denial of service on affected UTT HiPER 1250GW devices. The attacker does not require authentication or user interaction, increasing the risk level. The high CVSS score reflects significant potential impact on device confidentiality, integrity, and availability. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of affected devices and monitor for unusual activity. Avoid relying on generic mitigations as no vendor-provided temporary fixes or workarounds have been documented.