H3C Magic B0 CVE-2026-9393

Attacker must reach the router's HTTP management interface (/goform/aspForm) over the network and must already hold low-privileged authenticated access to the web UI (CVSS PR:L) - typically a valid web admin or guest-admin account, which on SOHO devices is often default/weak credentials. Exploitation specifically requires invoking the Edit_BasicSSID_5G handler with an oversized param argument, so it targets the 5 GHz SSID configuration code path. Limiting factors: the management interface is by default exposed only to the LAN, so WAN-side exploitation requires remote management to be enabled or the device to be otherwise exposed; the affected firmware range is H3C Magic B0 up to 100R002; SSVC marks Automatable=no, indicating reliable mass-scale weaponization is not established despite POC availability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a low-complexity network-reachable attack requiring low privileges and no user interaction, with high impact on the vulnerable component but no scope change to other systems - yielding a base score of 7.4. SSVC mirrors this: Exploitation=poc, Automatable=no, Technical Impact=total, which justifies prioritization but not emergency response. EPSS is very low at 0.04% (13th percentile) and the CVE is not in CISA KEV, so real-world mass exploitation is unlikely; however, publicly available exploit code (referenced GitHub issue) lowers the barrier for targeted attacks against exposed devices. A key limiting factor is the PR:L requirement - an attacker must already hold low-privileged authenticated access to the router web UI, which on SOHO devices often means default or weak credentials reachable from the LAN, and rarely from the WAN unless remote management is enabled. The most notable conflict is between high CVSS/total-impact and the vendor's non-response, which means defenders cannot rely on a patch.

An attacker who has obtained low-privileged web UI credentials on an H3C Magic B0 router - for example via default or reused credentials on a LAN-reachable or WAN-exposed admin portal - sends a crafted POST to /goform/aspForm targeting Edit_BasicSSID_5G with an oversized param value. Publicly available exploit code (referenced at https://github.com/alc9700jmo/CVE/issues/25) demonstrates the buffer overflow, which can crash the router or, with reliable offsets for the specific firmware build, execute attacker-controlled code as the web service user, giving full control of the gateway and the LAN behind it.