CVE-2026-11516
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
UTT HiPER 2610G router up to version 3.0.0-171107 has a buffer overflow in the strcpy function of the file /goform/formNatStaticMap when manipulating the NatBinds argument. The exploit has been made public and could be used.
Risk Assessment
An attacker can remotely crash the router or potentially execute arbitrary code, leading to device compromise.
Recommendation
Apply available firmware updates or restrict management interface access to trusted networks only.
Other vulnerabilities in UTT HiPER 2610G
See all- CVE-2026-78169Critical
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects the strcpy function in the file /goform/aspRemoteApConfTempSend of the HTTP Request Handler component. Manipulating the Profile argument results in a stack-based buffer overflow. The attack can be carried out remotely, and the exploit is public.
- CVE-2026-76004Critical
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535, affecting the strcpy function in /goform/aspApBasicConfigUrcp. Manipulation of pvid leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
- CVE-2026-76003Critical
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306, affecting the strcpy function in /goform/formGroupConfig. Manipulation of timestart leads to stack-based buffer overflow. Remote attack is possible and exploit is public.
- CVE-2026-78170High
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306 in the strcpy function of the file /goform/formConfigFastDirectionW. Manipulating the ssid argument can lead to buffer overflow. The attack may be performed remotely and the exploit has been published.
- CVE-2026-19341High
A stack-based buffer overflow vulnerability exists in UTT HiPER 1200GW up to 2.5.3-170306 in the strcpy function of /goform/pptpSrvGlobalConfig. Manipulating the EncryptionMode argument allows remote code execution. The exploit is public, and the vendor did not respond.
- CVE-2026-18898High
A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-18897High
A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
- CVE-2026-18895High
A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
- CVE-2026-14721High
A vulnerability was found in UTT HiPER 1250GW up to version 3.2.7-210907-180535 in the file /goform/ConfigWirelessBase_5g. Manipulation of the ssid argument leads to a stack-based buffer overflow, potentially allowing remote code execution. The exploit has been publicly disclosed.
- CVE-2026-11517High
Buffer overflow vulnerability in the strcpy function in /goform/formConfigDnsFilterGlobal on UTT HiPER 2610G up to version 3.0.0-171107. Manipulating the GroupName argument can lead to buffer overflow.
Original NVD description (English source)
A vulnerability was found in UTT HiPER 2610G up to 3.0.0-171107. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBinds results in buffer overflow. The exploit has been made public and could be used.