CVE-2026-9627

HighCVSS 8.8/10Last modified Jul 24, 2026

Description

A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web Management Interface. The manipulation of the argument sysAdmUser/sysAdmPass results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-962707.2The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v CVE-2026-962717.1Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to CVE-2026-962727.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passe CVE-2026-962735.5Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException CVE-2026-962747.4In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contain CVE-2026-962758.8A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extrac CVE-2026-962766.5If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writabl CVE-2026-962778.7Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache T CVE-2026-962787.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up CVE-2026-962796.5A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak applicati CVE-2026-96288.8A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientCon CVE-2026-962807.5The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit sy