CVE-2026-11517

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strcpy of the file /goform/formConfigDnsFilterGlobal. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

VendorProductVersions
UTTHiPER 2610G3.0.0-171107

References

Timeline

Published
Jun 8, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-115184.3A vulnerability was identified in SourceCodester Inventory System 1.0. Affected is an unknown function of the file /users.php of the componeCVE-2026-1151832.4The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities iCVE-2026-1151889.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, tCVE-2026-1151898.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict userCVE-2026-115196.3A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of thCVE-2026-1151908.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.CVE-2026-1151917.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameterCVE-2026-1151927.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the CVE-2026-1151938.2A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields aCVE-2026-1151946.5A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not reCVE-2026-1151956.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for seveCVE-2026-1151965.4An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applic