CVE-2026-9628Disclosure

LOWCVSS 7.4 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientConfig of the component Web Management Interface. This manipulation of the argument PPTP server address/username/password/tunnel name causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

DFIR Lab@DFIR_Lab91d
Disclosure
🚨 HIGH SEVERITY: CVE-2026-9628 (CVSS 8.8) Stack-based buffer overflow in UTT HiPER 1200GW routers (≤v2.5.3-170306). Public exploit available. Remote attack via Web Management Interface. Affected: /goform/formPptpClientConfig #CVE #Vulnerability #PatchNow https://t.co/RXTPiDZdSf
Post summary
The tweet announces CVE‑2026‑9628, a stack‑based buffer overflow in UTT HiPER 1200GW routers, indicating a public exploit is available via the Web Management Interface on a specific endpoint. No patches, exploit code details, or active exploitation reports are provided.
0000045
97 followersView on X

Explore more

Back to dashboard