A buffer overflow flaw exists in the start_lan function of the /apply.cgi script on certain models of the Shenzhen Libituo Technology LBT‑T300‑HW1 router. By manipulating the Channel or ApCliSsid parameter, an attacker can overrun a stack buffer, potentially gaining the ability to execute arbitrary code with the privileges of the web‑server process on the device. The vulnerability enables an attacker to compromise the confidentiality, integrity, and availability of the router remotely if exploited successfully.

The flaw is present in all firmware releases up to version 1.2.8 of the LBT‑T300‑HW1 product line from Shenzhen Libituo Technology. No other affected products are listed.

The CVSS score of 8.7 indicates a high severity of the bug, and the EPSS score is currently not available. The vulnerability is not yet listed in CISA's KEV catalog, but a public exploit has already been disclosed and the vendor has not yet responded with a fix. Because the attack vector is remote and the web interface is exposed to the network, the risk of exploitation remains high, especially for devices connected directly to the internet.