UTT HiPER Buffer Overflow Vulnerability in DNS Filter Configuration

A buffer overflow vulnerability has been identified in UTT HiPER version 2610G, up to 3.0.0-171107. The issue arises in the 'strcpy' function within the '/goform/formConfigDnsFilterGlobal' file. By manipulating the 'GroupName' argument, an attacker can exploit this vulnerability remotely. The exploit has been publicly disclosed and may be actively used.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a crash.

Reproduction

To reproduce this vulnerability, send a crafted request to the '/goform/formConfigDnsFilterGlobal' endpoint, manipulating the 'GroupName' argument to trigger the buffer overflow. This can be done remotely.