The vulnerability CVE-2026-9631 affects UTT HiPER 1250GW up to version 3.2.7-210907-180535. It arises from improper handling of input in the strcpy function used in the Web Management Interface component, specifically in the /goform/formConfigFastDirectionW endpoint. By manipulating the Profile parameter, an attacker can cause a stack-based buffer overflow remotely. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, but with high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with exploit code available, but no vendor patch or official fix has been announced.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, potentially allowing remote attackers to execute arbitrary code or cause denial of service on the affected device. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are currently no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Web Management Interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.