H3C Magic B0 CVE-2025-14015

Exploitation requires a low-privileged authenticated session (PR:L) to the H3C Magic B0 web management interface, then a crafted HTTP request to the endpoint /goform/aspForm invoking the EditWlanMacList handler with an over-length 'param' argument that overflows a fixed buffer. Limiting factors: valid (even low-privilege) credentials or a session to the device are needed, and the management interface on this SOHO-class router is typically exposed only to the LAN rather than the internet, narrowing realistic reach; no user interaction is required once access is obtained. No vendor patch is available, so no fixed version limits exposure.

This is a moderate-risk vulnerability whose signals are consistent but unexceptional. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates a low-privilege authenticated attacker can achieve high impact to confidentiality, integrity, and availability over the network with no user interaction - characteristic of memory-corruption on a router web endpoint. Against this, the EPSS score is low at 0.16% (37th percentile), indicating limited observed/predicted exploitation activity, and the CVE is NOT on the CISA KEV list, so there is no confirmed active exploitation. A public exploit (POC) does exist (referenced GitHub write-up) and the CVSS 4.0 Exploit Maturity is E:P (Proof-of-Concept), which raises baseline concern but does not equate to in-the-wild use. The PR:L requirement is a meaningful mitigant - exploitation presupposes at least low-privileged access to the device management interface, which for a consumer/SOHO router is typically LAN-adjacent rather than internet-facing, so the practical attack surface is narrower than AV:N alone suggests. A notable aggravating factor is the vendor non-response: no patch or advisory has been published, leaving affected devices without a confirmed fix. Net assessment: a real but non-urgent issue for most environments - prioritize where H3C Magic B0 routers are deployed and reachable, but it does not rise to emergency patching priority given low EPSS, absence from KEV, and the authentication prerequisite.

An attacker with low-privileged access to an H3C Magic B0 router's web management interface sends a crafted request to /goform/aspForm invoking the EditWlanMacList function with an oversized 'param' value, triggering a buffer overflow. Because a public proof-of-concept already exists, the barrier to replication is low, and a successful overflow could crash the device or lead to arbitrary code execution. Realistically the attacker must first reach the management interface, which for this SOHO router is usually accessible from the local network rather than the public internet.