The vulnerability CVE-2026-10259 affects H3C Magic B0 up to version 100R002. It is a stack-based buffer overflow in the SetMobileAPInfoById function of the /goform/aspForm file. An attacker can remotely manipulate an argument parameter to trigger the overflow, which may lead to arbitrary code execution or denial of service. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not provided any patch or remediation guidance, and the exploit details have been publicly disclosed.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the high CVSS score and the nature of the vulnerability, the impact is significant for affected systems. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying network-level protections such as restricting access to the affected service and monitoring for suspicious activity targeting the /goform/aspForm endpoint. Stay alert for any future vendor advisories or patches.