Magic B0 CVE-2026-6560

Valid low-privilege administrative credentials to the H3C Magic B0 router web management interface. CVSS vector PR:L (low privileges required) indicates standard router admin or user-level access suffices - not necessarily full administrator rights. Attack succeeds against default configurations with no special feature enablement required beyond accessible web management interface (typically enabled by default on consumer routers). Network accessibility (AV:N) permits exploitation from both LAN-side and WAN-side if remote administration is enabled, though most consumer routers restrict admin access to LAN by default. No user interaction required (UI:N) once authenticated session established. Exploitation IS LIMITED by need for credential theft as prerequisite attack phase, and by network reachability constraints in deployments with properly configured firewall rules blocking external admin access.

Real-world risk is MODERATE-HIGH for deployed devices but constrained by authentication requirement. CVSS4.0 7.4 (AV:N/AC:L/PR:L) correctly reflects network attack vector with low-privilege authentication needed - attackers must first obtain valid router credentials via phishing, credential stuffing, or default password abuse. Public exploit availability (GitHub repository linked in references) significantly lowers exploitation barrier for authenticated attackers. However, CVSS Environmental score modifier E:P (proof-of-concept exists) is already factored. No EPSS or CISA KEV data provided, but vendor non-responsiveness per description suggests no patch exists, extending vulnerability window indefinitely. Attack complexity is low (AC:L) once authenticated. Scope unchanged (SC:N/SI:N/SA:N) limits impact to the compromised router itself, but complete device compromise (VC:H/VI:H/VA:H) enables persistent access, traffic interception, and pivot attacks into connected networks. Priority depends on deployment context: HOME/SOHO users face lower risk (credential theft less likely); ENTERPRISE deployments with centralized management or exposed admin interfaces face higher risk. CRITICAL GAP: No independent verification of affected firmware versions beyond vendor-supplied CPE - actual version range may differ.

An attacker obtains valid administrative credentials for an H3C Magic B0 router through password reuse from a previous breach or social engineering. They craft a malicious HTTP POST request to the /goform/aspForm endpoint, targeting the Edit_BasicSSID function with an oversized 'param' value designed to overflow the input buffer. The overflow overwrites return addresses on the stack, redirecting execution to attacker-supplied shellcode embedded in the request. With full router compromise achieved, the attacker installs persistent backdoor firmware, intercepts DNS queries to redirect banking traffic to phishing sites, and uses the router as a pivot point to scan and attack devices on the internal network. Public exploit code on GitHub (linked in references) provides working proof-of-concept for this attack chain.