The UTT HiPER 1250GW device up to version 3.2.7-210907-180535 contains a stack-based buffer overflow vulnerability in the Web Management Interface component, specifically in the strcpy function handling the Profile argument in /goform/formGroupConfig. This flaw allows remote attackers to cause a buffer overflow by sending crafted input, potentially leading to arbitrary code execution or denial of service. The vulnerability has been assigned CVE-2026-9632 and carries a CVSS 4.0 score of 8.7 (high severity). Although an exploit is publicly available, no official patch or remediation level has been disclosed by the vendor as of the published date.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. The vulnerability requires no user interaction or privileges and can be triggered remotely. The presence of a public exploit increases the likelihood of exploitation attempts. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Web Management Interface to trusted networks only and monitor for any suspicious activity targeting the /goform/formGroupConfig endpoint. Avoid exposing the management interface to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.