CVE-2026-4488

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the file /goform/setSysAdm. Such manipulation of the argument GroupName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	HiPER 1250GW	3.2.7-210907-180535

References

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-448808.8A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could al CVE-2026-448819.9Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448828.1Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448837.5Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448846.5Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448855.5Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448868.7Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint i CVE-2026-448879.8Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allow CVE-2026-448889.8Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes use CVE-2026-448896.1WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is CVE-2026-44898.8A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /g CVE-2026-448907.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Fin