The flaw is a stack‑based buffer overflow in the R7WebsSecurityHandler function, which processes POST requests to /goform/wx3auth. An attacker that can send crafted POST data to the router can overflow an internal buffer, potentially leading to arbitrary code execution on the device. The flaw is exploitable remotely and the vulnerability is already publicly documented.

The vulnerability affects IP‑COM W30AP routers running firmware versions up to 1.0.0.11(1340). Any device in this family that has not been updated beyond that firmware revision is exposed.

The CVSS score of 9.3 indicates critical severity. The EPSS score is less than 1 %, suggesting few exploitation attempts have been seen yet, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the vulnerability is vendor‑agnostic in the sense that any attacker who discovers the target IP can send malicious POST data. Because the flaw overflows a stack buffer, successful exploitation could give the attacker remote code execution or provide a foothold for further compromise. No patch has been released by the vendor, and the vendor did not respond to preliminary notifications.