This vulnerability in UTT HiPER 1200GW up to version 2.5.3-170306 is a stack-based buffer overflow triggered by manipulation of parameters in the /goform/formPptpClientConfig endpoint of the Web Management Interface. The affected parameters include PPTP server address, username, password, and tunnel name. The flaw allows remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7, reflecting high impact and ease of exploitation without user interaction. Public exploit code is available, but no vendor patch or official remediation has been published to date.

Successful exploitation could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device by exploiting the stack-based buffer overflow in the Web Management Interface. The vulnerability does not require user interaction and can be triggered remotely over the network. The presence of public exploit code increases the likelihood of attacks. The device's confidentiality, integrity, and availability could be severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Web Management Interface, especially the /goform/formPptpClientConfig endpoint, by using network segmentation or firewall rules to limit exposure to trusted administrators only. Monitor for unusual activity targeting this interface. Do not rely on generic mitigations; follow vendor updates closely.