# CVE-2026-78169: UTT HiPER 1250GW stack buffer overflow in HTTP request handler

Source: https://junglewise.ai/threats/cve-2026-78169-utt-hiper-1250gw-stack-buffer-overflow-in-http-request-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78169 · Severity: critical · CVSS 9.9 · Published 2026-08-24

The UTT HiPER 1250GW router is a network appliance used to manage corporate and small-office internet connectivity. A stack buffer overflow vulnerability in the remote AP configuration endpoint allows attackers with network access to send specially crafted requests that crash the device, causing a denial of service. This can disrupt internet connectivity for all users depending on the router.

Technologies: [UTT HiPER 1250GW](https://junglewise.ai/threats/technologies/hiper-1250gw). Vendors: [UTT](https://junglewise.ai/threats/vendors/utt).

## Quick answers

**Is CVE-2026-78169 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78169 being exploited in the wild.

**How severe is CVE-2026-78169?** Critical severity, with a CVSS score of 9.9, published 24 August 2026.

**Which products and versions are affected?** UTT HiPER 1250GW up to 3.2.7-210907-180535.

**Is there a fix for CVE-2026-78169?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78169 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-78169?** Check whether you run UTT HiPER 1250GW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack buffer overflow vulnerability exists in the HTTP request handler component at the /goform/aspRemoteApConfTempSend endpoint. The vulnerable function uses strcpy() without bounds checking to copy user-supplied input from the "Profile" (or similar "remoteSrcTemp") parameter into a fixed-size buffer. An attacker with network access to the device can send an oversized string to overflow the stack, overwriting the return address or other sensitive data. This allows remote code execution or denial of service. The vulnerability affects UTT HiPER 1250GW firmware version 3.2.7-210907-180535 and earlier; patch availability has not been confirmed.

## Affected products

- UTT HiPER 1250GW up to 3.2.7-210907-180535

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: advisory

## References

- [https://github.com/7wkajk/CVE-VUL/blob/main/107.md](https://github.com/7wkajk/CVE-VUL/blob/main/107.md)
- [https://vuldb.com/cve/CVE-2026-78169](https://vuldb.com/cve/CVE-2026-78169)

## Related threats

- [UTT HiPER 1250GW stack buffer overflow in getOneApConfTempEntry](https://junglewise.ai/threats/cve-2026-18897-utt-hiper-1250gw-stack-buffer-overflow-in-getoneapconftempentry)
- [UTT HiPER 1250GW stack buffer overflow in APSecurity_5g](https://junglewise.ai/threats/cve-2026-18895-utt-hiper-1250gw-stack-buffer-overflow-in-apsecurity-5g)
- [UTT HiPER 1250GW stack overflow in ConfigWirelessBase_5g](https://junglewise.ai/threats/cve-2026-14721-utt-hiper-1250gw-stack-overflow-in-configwirelessbase-5g)
- [UTT HiPER Router stack buffer overflow in formFireWall](https://junglewise.ai/threats/cve-2026-10293-utt-hiper-router-stack-buffer-overflow-in-formfirewall)
- [UTT HiPER 1250GW stack overflow in formGroupConfig](https://junglewise.ai/threats/cve-2026-9632-utt-hiper-1250gw-stack-overflow-in-formgroupconfig)