H3C Magic B0 EUVD-2026-33638

H3C Magic B0 is a consumer/SOHO wireless router from H3C Technologies. The vulnerability resides in the web management interface, specifically the SetMobileAPInfoById handler reachable via the /goform/aspForm endpoint - a common ASP-style form handler pattern used in embedded router firmware. The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), manifesting as a stack-based buffer overflow when the 'param' argument is processed without adequate length validation, likely via an unsafe string copy operation (e.g., strcpy/sprintf) into a fixed-size stack buffer. Successful exploitation can corrupt the call stack and potentially redirect execution to attacker-controlled code on the MIPS/ARM SoC typical of such devices. No CPE strings were provided in the intelligence data to enumerate exact hardware revisions.