{"id":"CVE-2026-18895","published":"2026-08-05T02:16:37.403","lastModified":"2026-08-05T15:16:45.587","description":"A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/7wkajk/CVE-VUL/blob/main/101.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-18895","tags":[]},{"url":"https://vuldb.com/submit/858607","tags":[]},{"url":"https://vuldb.com/vuln/385930","tags":[]},{"url":"https://vuldb.com/vuln/385930/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/7wkajk/CVE-VUL/blob/main/101.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is a stack-based buffer overflow in the strcpy function due to improper handling of the cipher argument, allowing remote attackers to exploit it. This matters because it can lead to arbitrary code execution or other severe impacts.","exploitability":"Exploitation is moderately hard as it requires crafting a specific payload to overflow the buffer, but it can be done remotely.","blast_radius":"If exploited, this could result in full control of the device, leading to data theft, denial of service, or other serious consequences.","remediation":"Upgrade to UTT HiPER 1250GW version 3.2.8-210907-181000 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","buffer-overflow","remote-exploit","web","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:21:32.698Z"}}