A stack-based buffer overflow exists in the SetMobileAPInfoById function of H3C Magic B0’s /goform/aspForm component, allowing an attacker who can send crafted requests to execute arbitrary code on the target system. The flaw arises from unsanitized input handling and is identified by CWE‑119 and CWE‑121. Exploitation would result in privilege escalation or complete compromise of the device, exposing sensitive network configuration data and potentially allowing further lateral movement.

The vulnerability affects H3C Magic B0 devices running firmware up to 100R002. No other vendors or versions are listed as impacted.

The CVSS score of 8.7 indicates a high severity, and the exploit is operable from remote hosts, as the attack requires only network-level access to the web interface. EPSS data is unavailable, and the vulnerability is not in the CISA KEV catalog, but the publicly disclosed exploit demonstrates realistic threat potential. Given the remote nature of the attack, any enabled or exposed instance of the web interface presents a direct risk to the entire device. The lack of vendor response further increases the urgency, as users must rely on self‑mitigation until an official fix is released.