CVE-2026-7420
Published: 29 April 2026
Summary
CVE-2026-7420 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-7420 is a buffer overflow vulnerability affecting the UTT HiPER 1250GW router in versions up to 3.2.7-210907-180535. The flaw occurs in the strcpy function within the file route/goform/ConfigAdvideo, where manipulation of the "Profile" argument leads to the overflow. It is classified under CWE-119 and CWE-120.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network with low complexity by attackers possessing low privileges. Successful exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service.
Advisories referenced in VULDB entries (e.g., https://vuldb.com/vuln/360157) and a GitHub repository (https://github.com/kirlic123/IOTvulner/blob/main/4035/5/5.md) detail the issue, noting that an exploit has been publicly released and may be used for attacks. No specific patch or mitigation steps are outlined in the available information.
The public availability of the exploit heightens the risk of real-world exploitation against unpatched UTT HiPER 1250GW devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26298
Vulnerability details
A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The manipulation of the argument Profile results in buffer overflow. The attack can be executed remotely. The exploit…
more
has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web form (/goform/ConfigAdvideo) on network router directly enables remote exploitation of public-facing application with low-priv access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs like the 'Profile' argument to prevent buffer overflows from oversized or malformed data in the ConfigAdvideo function.
SI-16 implements memory protections such as stack canaries, ASLR, and non-executable memory to mitigate exploitation of the strcpy buffer overflow vulnerability.
SI-2 mandates timely identification, reporting, and remediation of flaws like this buffer overflow, including patching the affected UTT HiPER 1250GW firmware.