UTT HiPER Buffer Overflow Vulnerability in the formUser Function

A buffer overflow vulnerability has been identified in UTT HiPER models 1200GW, versions up to 2.5.3-1703. The issue arises in the formUser function, where improper use of the strcpy function creates the potential for a buffer overflow. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the /goform/formUser endpoint. The request must include a payload that exceeds the buffer size, taking advantage of the vulnerable strcpy function. This can be done using a variety of tools or scripts that automate the process of sending such requests.