Cyber Posture

CVE-2026-3016

HighPublic PoC

Published: 23 February 2026

Published
23 February 2026
Modified
24 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PLimitConfig. The manipulation of the argument except leads to buffer overflow. Remote exploitation of the attack is possible. The…

more

exploit is publicly available and might be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the buffer overflow vulnerability in the strcpy function by identifying, reporting, and correcting the flaw in a timely manner.

SI-10 Information Input Validation good match
prevent

Validates the 'except' argument in /goform/formP2PLimitConfig to prevent buffer overflow from manipulated inputs.

SI-16 Memory Protection partial match
prevent

Implements memory safeguards like non-executable stacks or address space randomization to mitigate arbitrary code execution from the buffer overflow.

Security SummaryAI

CVE-2026-3016 is a buffer overflow vulnerability affecting UTT HiPER 810G devices running versions up to 1.7.7-171114. The issue resides in the strcpy function within the /goform/formP2PLimitConfig file, where manipulation of the "except" argument triggers the overflow. This flaw, linked to CWE-119 and CWE-120, was published on 2026-02-23 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, granting high confidentiality, integrity, and availability impacts, potentially leading to full device compromise. A public proof-of-concept exploit is available, increasing the risk of widespread abuse.

Advisories referenced in VulDB entries and a GitHub repository detail the vulnerability, including a PoC demonstrating the buffer overflow via the affected form endpoint. No specific patches or mitigation steps are outlined in the provided description or references. Security practitioners should isolate affected devices and monitor for exploitation attempts using the public PoC.

Details

CWE(s)
CWE-119CWE-120

Affected Products

utt
810g firmware
≤ 1.7.7-171114

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in exposed /goform web endpoint (AV:N) with low-priv auth allows remote arbitrary code execution and full device compromise, directly enabling T1190 (public-facing app exploitation) and T1068 (priv-escalation via memory corruption).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References