EUVD-2026-23690Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Buffer overflow in H3C Magic B1 router firmware (versions through 100R004) allows authenticated remote attackers to achieve complete system compromise via crafted parameters to the SetAPWifiorLedInfoById function in /goform/aspForm. Public exploit code exists on GitHub. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated access to H3C Magic B1 router's web management interface with low-privilege credentials (CVSS PR:L) - specifically, access to the /goform/aspForm endpoint which is part of the administrative control panel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.4 (High) indicates network-reachable exploitation with low complexity requiring only low-privilege authentication (PR:L), delivering high confidentiality, integrity, and availability impact with no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the internet or an internal network authenticates to the H3C Magic B1 router's web interface using compromised, default, or brute-forced administrative credentials (PR:L). The attacker crafts an HTTP POST request to /goform/aspForm containing an oversized 'param' value targeting the SetAPWifiorLedInfoById function, triggering a buffer overflow that overwrites memory and executes attacker-controlled shellcode with root privileges. … |
| Remediation | No vendor-released patch identified at time of analysis - H3C did not respond to vulnerability disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all H3C Magic B1 routers in your environment and document current firmware versions via management console or administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today