This vulnerability involves a buffer overflow caused by improper handling of an argument parameter in the SetAPWifiorLedInfoById function of the H3C Magic B1 device firmware up to version 100R004. An attacker can remotely trigger this overflow via a specially crafted request to /goform/aspForm, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. The vendor has not issued any patch or advisory, and the exploit has been publicly disclosed.

Successful exploitation of this buffer overflow may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. Given the high CVSS score and the remote attack vector without user interaction, the impact on confidentiality, integrity, and availability is high. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for official updates from H3C. In the meantime, restricting network access to the device's management interface and applying network-level protections may reduce exposure.