This vulnerability affects UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The issue lies in the handling of the Profile argument in the Web Management Interface's /goform/formGroupConfig endpoint, where the use of the unsafe strcpy function can cause a stack-based buffer overflow. The vulnerability is remotely exploitable without authentication or user interaction, and an exploit is publicly available. The CVSS 4.0 base score is 8.7, reflecting high impact on confidentiality, integrity, and availability. No official patch or mitigation has been disclosed by the vendor as of the published date.

Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected device, potentially allowing an attacker to compromise the device's confidentiality, integrity, and availability. Given the remote exploitability and the availability of a public exploit, affected devices are at significant risk. This may result in device takeover or disruption of network management functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's Web Management Interface to trusted networks only and monitor for any suspicious activity. Avoid exposing the management interface to untrusted networks or the internet. Follow vendor communications closely for updates on patches or official mitigations.