Is CVE-2026-9628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9628 being exploited in the wild.

How severe is CVE-2026-9628?

High severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

UTT HiPER 1200GW up to 2.5.3-170306.

Is there a fix for CVE-2026-9628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9628 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9628?

Check whether you run UTT HiPER 1200GW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9628: UTT HiPER 1200GW stack overflow in formPptpClientConfig

CVE-2026-9628 · Severity: high · CVSS 8.8 · Published 2026-05-27

UTT HiPER 1200GW routers are affected by a security vulnerability in their web management interface. An attacker with access to the management console can send specially crafted data to the PPTP client configuration page to crash the device or potentially take full control of it. This could lead to a complete disruption of network services and unauthorized access to the router's internal settings.

Technologies: UTT HiPER 1200GW. Vendors: UTT.

Quick answers

Is CVE-2026-9628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9628 being exploited in the wild.
How severe is CVE-2026-9628?: High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: UTT HiPER 1200GW up to 2.5.3-170306.
Is there a fix for CVE-2026-9628?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9628 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9628?: Check whether you run UTT HiPER 1200GW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow vulnerability exists in the UTT HiPER 1200GW router's web management interface within the /goform/formPptpClientConfig endpoint. The issue stems from improper bounds checking when handling parameters such as the PPTP server address, username, password, or tunnel name, specifically involving an unsafe 'strcpy' operation. An attacker with low-privileged credentials can exploit this by sending a crafted POST request with overly long strings in the affected parameters. Successful exploitation can lead to arbitrary code execution or a denial of service (DoS) condition. Public exploit code has been released.

Affected products

UTT HiPER 1200GW up to 2.5.3-170306

Timeline

2026-05-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.