CVE-2026-10259
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In H3C Magic B0 up to version 100R002, a vulnerability exists in the SetMobileAPInfoById function of the /goform/aspForm file. Manipulation of the param argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely cause device crashes or potentially execute arbitrary code, compromising network security.
Recommendation
Contact H3C for a firmware update or consider replacing the device with a patched model.
Other vulnerabilities in H3C Magic B0
Original NVD description (English source)
A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the file /goform/aspForm. Such manipulation of the argument param leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.