Which versions of H3C Magic B0 are affected by EUVD-2026-31549?

H3C Magic B0 routers (firmware up to version 100R002) are vulnerable to a publicly exploitable buffer overflow that allows authenticated attackers to compromise system memory and device integrity.

Is there a public PoC exploit available for EUVD-2026-31549?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31549. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31549?

Within 24 hours: Identify and inventory all H3C Magic B0 routers; document firmware versions (up to 100R002); isolate affected devices using network segmentation. Within 7 days: Check vendor advisories for any firmware updates beyond version 100R002; begin evaluation of replacement hardware. Within 30 days: Complete migration plan to unaffected router models; if replacement is not feasible, implement persistent network-level compensating controls and establish monitoring for any future vendor security releases.

H3C Magic B0 EUVD-2026-31549

Q: What is the CVSS score of EUVD-2026-31549?

EUVD-2026-31549 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9393 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-24 VulDB

GHSA-mx2p-2hcq-xr76

Buffer Overflow Magic B0

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:54 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was found in H3C Magic B0 up to 100R002. This affects the function Edit_BasicSSID_5G of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Buffer overflow in the H3C Magic B0 router (firmware up to 100R002) allows authenticated remote attackers to corrupt memory via the param argument handled by the Edit_BasicSSID_5G function in /goform/aspForm, leading to high impact on confidentiality, integrity, and availability. Publicly available exploit code exists per VulDB, though EPSS remains very low (0.04%, 13th percentile) and the issue is not listed in CISA KEV, indicating no public exploit identified as actively used at time of analysis. The vendor was contacted but did not respond, increasing risk of an unpatched window for exposed devices.

Technical ContextAI

The flaw is a classic CWE-120 classic buffer overflow in the embedded web management interface of an H3C Magic B0 consumer/SOHO router. The vulnerable code path is the Edit_BasicSSID_5G handler in the binary CGI dispatcher reachable through /goform/aspForm, which processes the 5 GHz SSID configuration request. The param argument is copied into a fixed-size stack or heap buffer without proper length validation, allowing memory corruption that on MIPS/ARM SOHO firmware typically leads to control-flow hijack or denial of service. The CPE cpe:2.3:a:h3c:magic_b0:*:*:*:*:*:*:*:* covers all releases up to and including 100R002.

RemediationAI

No vendor-released patch identified at time of analysis - H3C did not respond to coordinated disclosure, so defenders should treat affected Magic B0 devices (firmware up to 100R002) as unpatched and apply compensating controls. Specifically, disable remote/WAN management of the router web interface so /goform/aspForm is not reachable from untrusted networks (trade-off: administrators must connect from the LAN or via VPN); restrict LAN access to the management interface via management VLAN or firewall ACLs to a small set of admin hosts (trade-off: more configuration overhead); rotate the web admin password to a strong unique value to raise the bar for the PR:L authentication requirement (trade-off: minor operational change); and monitor H3C's support site (linked via the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-9393 and VulDB https://vuldb.com/vuln/365374) for an eventual firmware update beyond 100R002. Where feasible, replace end-of-support or unresponsive-vendor SOHO devices with a maintained model.