Is CVE-2026-78170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78170 being exploited in the wild.

How severe is CVE-2026-78170?

High severity, with a CVSS score of 8.8, published 24 August 2026.

Which products and versions are affected?

UTT HiPER 1200GW up to 2.5.3-170306.

Is there a fix for CVE-2026-78170?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78170 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-78170?

Check whether you run UTT HiPER 1200GW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78170: UTT HiPER 1200GW buffer overflow in formConfigFastDirectionW

CVE-2026-78170 · Severity: high · CVSS 8.8 · Published 2026-08-24

The UTT HiPER 1200GW is a network router used in corporate and small-business environments to manage internet connectivity and routing. A remote attacker can trigger a buffer overflow vulnerability by sending a specially crafted web request with an oversized SSID parameter, potentially causing the device to crash, become unavailable, or execute arbitrary code.

Technologies: UTT HiPER 1200GW. Vendors: UTT.

Quick answers

Is CVE-2026-78170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78170 being exploited in the wild.
How severe is CVE-2026-78170?: High severity, with a CVSS score of 8.8, published 24 August 2026.
Which products and versions are affected?: UTT HiPER 1200GW up to 2.5.3-170306.
Is there a fix for CVE-2026-78170?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78170 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-78170?: Check whether you run UTT HiPER 1200GW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic buffer overflow in the /goform/formConfigFastDirectionW API endpoint, where unsanitized user input from the "ssid" parameter is copied into a fixed-size buffer using strcpy without bounds checking. The vulnerable code path is triggered when the "wrlessMode" parameter is set to 4, causing the application to copy the ssid value into memory at offset +24 from a pointer without validating string length. The attack requires network access to the router's web management interface and authentication credentials (Digest authentication is shown in the POC); an attacker who gains access to the management interface can supply an arbitrarily long ssid value to overflow the stack or heap. Successful exploitation can lead to denial of service (device crash) or potentially code execution depending on memory layout. Patches for firmware versions beyond 2.5.3-170306 have not been identified in the advisory.

Affected products

UTT HiPER 1200GW up to 2.5.3-170306

Timeline

2026-08-24: disclosed: CVE-2026-78170 published; exploit PoC available on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.