CVE-2026-1162

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argument passwd1 causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	HiPER 810	1.7.4-141218

References

https://github.com/cha0yang1/UTT810/blob/main/1.mdBroken Link
https://github.com/cha0yang1/UTT810/blob/main/1.md#pocBroken Link
https://vuldb.com/?ctiid.341756Permissions Required, VDB Entry
https://vuldb.com/?id.341756Third Party Advisory, VDB Entry
https://vuldb.com/?submit.736511Third Party Advisory, VDB Entry

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-116205.3A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the comp CVE-2026-116214.7A weakness has been identified in Dcat-Admin up to 2.2.3-beta. This impacts the function editorMDUpload of the file /admin/dcat-api/editor-m CVE-2026-116227.5A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The CVE-2026-116234.5A security vulnerability has been detected in tmux up to 3.6a. Affected is the function image_free of the file image.c. Such manipulation le CVE-2026-116249.4The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DN CVE-2026-116257.5Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before for CVE-2026-116265.4CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of is CVE-2026-116286.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physica CVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active CVE-2026-116308.8Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a CVE-2026-116318.3Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer proces