CVE-2026-3016
Published: 23 February 2026
Summary
CVE-2026-3016 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 810G Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability in the strcpy function by identifying, reporting, and correcting the flaw in a timely manner.
Validates the 'except' argument in /goform/formP2PLimitConfig to prevent buffer overflow from manipulated inputs.
Implements memory safeguards like non-executable stacks or address space randomization to mitigate arbitrary code execution from the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in exposed /goform web endpoint (AV:N) with low-priv auth allows remote arbitrary code execution and full device compromise, directly enabling T1190 (public-facing app exploitation) and T1068 (priv-escalation via memory corruption).
NVD Description
A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PLimitConfig. The manipulation of the argument except leads to buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit is publicly available and might be used.
Deeper analysisAI
CVE-2026-3016 is a buffer overflow vulnerability affecting UTT HiPER 810G devices running versions up to 1.7.7-171114. The issue resides in the strcpy function within the /goform/formP2PLimitConfig file, where manipulation of the "except" argument triggers the overflow. This flaw, linked to CWE-119 and CWE-120, was published on 2026-02-23 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, granting high confidentiality, integrity, and availability impacts, potentially leading to full device compromise. A public proof-of-concept exploit is available, increasing the risk of widespread abuse.
Advisories referenced in VulDB entries and a GitHub repository detail the vulnerability, including a PoC demonstrating the buffer overflow via the affected form endpoint. No specific patches or mitigation steps are outlined in the provided description or references. Security practitioners should isolate affected devices and monitor for exploitation attempts using the public PoC.
Details
- CWE(s)