A buffer overflow flaw exists in the Shenzhen Libituo Technology LBT‑T300‑HW1 firmware, affecting the start_single_service function of the Web Management Interface. The vulnerability is triggered by manipulating the vpn_pptp_server or vpn_l2tp_server arguments, causing an overflow of an internal buffer. Because this function can be invoked remotely via the web interface, an attacker could cause a crash or potentially execute arbitrary code, compromising the device fully. The weakness is categorized as CWE-119 and CWE-120 – unbounded buffer writes caused by unsanitized input.

The affected device is the Shenzhen Libituo Technology LBT‑T300‑HW1 router. Firmware versions up to 1.2.8 contain the flaw. No newer firmware releases have been reported to include a fix at this time.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available, so exploitation probability cannot be quantified; however, the high CVSS and remote attack vector imply significant risk. The flaw is not listed in the CISA KEV catalog. Attackers would need network reachability to the device’s management interface; authentication is not described as bypassable, so a valid user session is likely required.