A buffer overflow in the SetMobileAPInfoById function of the /goform/aspForm file allows a remote attacker to manipulate the param argument and trigger overflow conditions. The exploit can be executed from any network host with access to the affected device, potentially leading to arbitrary code execution on the device. The vulnerability is classified as CWE-119 and CWE-120 and carries a CVSS score of 8.7, indicating a high severity level.

The flaw exists in H3C Magic B1 devices running firmware versions up to 100R004. The product name is H3C Magic B1 and the affected range includes all releases through 100R004. No other vendors or product lines are listed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the public availability of the exploit and the remote nature of the attack vector indicate a realistic risk of exploitation. Attackers can target the web interface to send crafted requests to the SetMobileAPInfoById API, causing a buffer overflow that could lead to remote code execution. The high CVSS score and the absence of mitigation from the vendor further increase the urgency of remediation.