Threats affecting pkg:github/hmkunlun/UTTHiPER

CVE-2026-4488 is a high-severity buffer overflow vulnerability in the UTT HiPER 1250GW device firmware up to version 3.2.7-210907-180535. The flaw exists in the strcpy function within the /goform/setSysAdm endpoint, where improper handling of the GroupName argument allows an attacker to overflow a buffer. This vulnerability can be exploited remotely without authentication or user interaction, potentially leading to full compromise of the device. Although no known exploits are currently observed in the wild, a public exploit is available, increasing the risk of exploitation. The vulnerability impacts confidentiality, integrity, and availability with high severity (CVSS 8.7). Organizations using this device should prioritize patching or mitigating this issue to prevent unauthorized access or device takeover.

CVE-2026-4487 is a high-severity buffer overflow vulnerability in UTT HiPER 1200GW devices up to version 2.5.3-170306. The flaw exists in the strcpy function within the /goform/websHostFilter endpoint, allowing remote attackers to trigger a buffer overflow without authentication or user interaction. Exploitation could lead to complete compromise of the affected device, impacting confidentiality, integrity, and availability. Although no known exploits are currently observed in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Organizations using these devices should prioritize patching or mitigating this issue to prevent potential remote code execution or denial of service. The vulnerability affects network infrastructure devices, making it critical for environments relying on UTT HiPER 1200GW for connectivity or security. Countries with significant deployments of UTT devices and strategic reliance on such network equipment are at higher risk. Immediate mitigation steps include restricting access to the vulnerable endpoint, network segmentation, and monitoring for anomalous activity targeting the device.