CVE-2026-2980

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in UTT HiPER 810G up to 1.7.7-1711. Impacted is the function strcpy of the file /goform/setSysAdm. The manipulation of the argument passwd1 leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-29818.8A vulnerability was found in UTT HiPER 810G up to 1.7.7-1711. The affected element is the function strcpy of the file /goform/formTaskEdit_a CVE-2026-298104.3CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CVE-2026-298117.7CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal CVE-2026-298124.3CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.CVE-2026-298286.1DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.CVE-2026-29839.8A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the fi CVE-2026-298398.8DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.CVE-2026-29846.5A vulnerability was identified in SourceCodester Student Result Management System 1.0. This affects an unknown function of the file /admin/c CVE-2026-298405.4JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserControll CVE-2026-29856.3A security flaw has been discovered in Tiandy Video Surveillance System 视频监控平台 7.17.0. This impacts the function downloadImage of the file /CVE-2026-298567.5An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial CVE-2026-298587.5A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information expos