Cyber Posture

CVE-2026-3015

HighPublic PoC

Published: 23 February 2026

Published
23 February 2026
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launched remotely. The exploit…

more

has been publicly disclosed and may be utilized.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of the GroupName input argument to ensure it does not exceed buffer bounds, directly preventing the strcpy buffer overflow exploitation.

SI-16 Memory Protection good match
prevent

Implements memory protections such as stack canaries, ASLR, and DEP to mitigate buffer overflow exploits even if invalid input reaches the vulnerable function.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of identified flaws like this buffer overflow through firmware patching or upgrades for affected UTT HiPER 810G versions.

Security SummaryAI

CVE-2026-3015 is a buffer overflow vulnerability affecting UTT HiPER 810G routers in versions up to 1.7.7-171114. The flaw exists in the strcpy function within the /goform/formPolicyRouteConf file, where manipulation of the GroupName argument triggers the overflow. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges can exploit this vulnerability remotely without requiring user interaction. By crafting a malicious request targeting the GroupName argument, the attacker triggers the buffer overflow, potentially achieving high-impact compromise including unauthorized access to sensitive data, modification of system integrity, and denial of service through availability disruption.

Advisories referenced on VulDB (ctiid.347375, id.347375, submit.756248) and a GitHub repository (xhsy0314/CVEReport) document the issue, including a publicly disclosed proof-of-concept exploit. No specific patch or mitigation details are outlined in the provided references.

Details

CWE(s)
CWE-119CWE-120

Affected Products

utt
810g firmware
≤ 1.7.7-171114

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in remotely accessible web form (/goform/formPolicyRouteConf) on public-facing router enables exploitation of the application over the network (T1190) and directly supports privilege escalation from low-privileged authenticated access to high-impact code execution (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References