The vulnerability CVE-2026-76004 affects UTT HiPER 1250GW up to version 3.2.7-210907-180535. It is a stack-based buffer overflow caused by improper handling of the 'pvid' argument in the strcpy function of the /goform/aspApBasicConfigUrcp HTTP handler. This allows remote attackers to overflow the stack, potentially enabling arbitrary code execution or denial of service. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. The CVSS 4.0 vector indicates high impact on confidentiality, integrity, and availability. Public exploit details have been disclosed, but no active exploitation has been confirmed. No vendor patch or mitigation guidance is currently available.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected devices running UTT HiPER 1250GW version 3.2.7-210907-180535. The attacker can trigger a stack-based buffer overflow by sending a specially crafted request manipulating the 'pvid' parameter to the HTTP handler. This compromises the confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interface to trusted sources only and monitor for suspicious activity targeting the /goform/aspApBasicConfigUrcp endpoint.