CVE-2026-9628 is a high-severity stack-based buffer overflow vulnerability in the UTT HiPER 1200GW device, specifically in an unknown function handling the /goform/formPptpClientConfig component of its Web Management Interface. The vulnerability arises from improper handling of arguments such as PPTP server address, username, password, or tunnel name, which can be manipulated remotely to trigger the overflow. Exploit code has been publicly disclosed, increasing the risk of attack. The vulnerability affects version 2.5.3-170306 of the product. No official patch or remediation guidance is currently available from the vendor. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector and no user interaction required.
A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web Management Interface. The manipulation of the argument sysAdmUser/sysAdmPass results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability has been found in UTT HiPER 1200GW up to 2.5.3-170306. The impacted element is the function strcpy of the file /goform/formRemoteControl. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-7512 is a high-severity buffer overflow vulnerability in UTT HiPER 1200GW firmware version up to 2.5.3-1703. The flaw exists in the strcpy function within the /goform/formUser file and can be exploited remotely without user interaction or privileges. An exploit has been published, increasing the risk of potential attacks. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-7420 is a high-severity buffer overflow vulnerability in the UTT HiPER 1250GW device, specifically affecting the strcpy function in the route/goform/ConfigAdvideo file. The vulnerability arises from improper handling of the Profile argument, allowing remote attackers to cause a buffer overflow. The vulnerability affects version 3.2.7-210907-180535 and earlier. An exploit has been publicly released, increasing the risk of attacks. There is no confirmed patch or official remediation available at this time.
CVE-2026-7419 is a high-severity buffer overflow vulnerability in UTT HiPER 1250GW devices up to version 3.2.7-210907-180535. The flaw exists in the strcpy function within the route/goform/formTaskEdit_ap file, where manipulation of the Profile argument can cause a buffer overflow. Remote exploitation is possible without user interaction, and a public exploit is available. No official patch or remediation guidance has been provided yet.
CVE-2026-7418 is a high-severity buffer overflow vulnerability in UTT HiPER 1250GW devices up to version 3.2.7-210907-180535. The flaw exists in the strcpy function within the route/goform/NTP file, where manipulation of the Profile argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
The Bread & Butter WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'breadbutter-customevent-button' shortcode. This vulnerability arises from improper sanitization and escaping of the 'event' attribute, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when any user clicks the injected button on affected pages. The issue is present in all versions up to 8.2.0.25. No official patch or remediation guidance is currently available.
The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-6186 is a high-severity buffer overflow vulnerability in UTT HiPER 1200GW firmware version 2.5.3-170306. The flaw exists in the strcpy function within the /goform/formNatStaticMap file, where manipulation of the NatBind argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBind results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. The impacted element is an unknown function of the file /goform/formRemoteControl. The manipulation of the argument Profile results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-4488 is a high-severity buffer overflow vulnerability in the UTT HiPER 1250GW device firmware up to version 3.2.7-210907-180535. The flaw exists in the strcpy function within the /goform/setSysAdm endpoint, where improper handling of the GroupName argument allows an attacker to overflow a buffer. This vulnerability can be exploited remotely without authentication or user interaction, potentially leading to full compromise of the device. Although no known exploits are currently observed in the wild, a public exploit is available, increasing the risk of exploitation. The vulnerability impacts confidentiality, integrity, and availability with high severity (CVSS 8.7). Organizations using this device should prioritize patching or mitigating this issue to prevent unauthorized access or device takeover.
CVE-2026-4487 is a high-severity buffer overflow vulnerability in UTT HiPER 1200GW devices up to version 2.5.3-170306. The flaw exists in the strcpy function within the /goform/websHostFilter endpoint, allowing remote attackers to trigger a buffer overflow without authentication or user interaction. Exploitation could lead to complete compromise of the affected device, impacting confidentiality, integrity, and availability. Although no known exploits are currently observed in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Organizations using these devices should prioritize patching or mitigating this issue to prevent potential remote code execution or denial of service. The vulnerability affects network infrastructure devices, making it critical for environments relying on UTT HiPER 1200GW for connectivity or security. Countries with significant deployments of UTT devices and strategic reliance on such network equipment are at higher risk. Immediate mitigation steps include restricting access to the vulnerable endpoint, network segmentation, and monitoring for anomalous activity targeting the device.
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
A weakness has been identified in UTT HiPER 810G up to 1.7.7-1711. This affects the function strcpy of the file /goform/formApMail. Executing a manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3814 is a high-severity buffer overflow vulnerability in the UTT HiPER 810G device firmware up to version 1.7.7-1711. The flaw exists in the strcpy function within the /goform/getOneApConfTempEntry endpoint, allowing remote attackers to trigger a buffer overflow without authentication or user interaction. Exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently observed in the wild, a public exploit has been released, increasing the risk of attacks. The vulnerability has a CVSS 4.0 score of 8.7, reflecting its ease of remote exploitation and severe impact. Organizations using this device should prioritize patching or mitigating this issue to prevent potential remote code execution or denial of service.
A weakness has been identified in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigDnsFilterGlobal. This manipulation causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in UTT HiPER 810G up to 1.7.7-171114. This impacts the function strcpy of the file /goform/formRemoteControl. The manipulation results in buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.