This vulnerability involves a buffer overflow in the SetMobileAPInfoById function of the H3C Magic B1 device firmware version 100R004. An attacker can remotely trigger the overflow by sending crafted input to the /goform/aspForm endpoint, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.7, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no user interaction required. The vendor has not issued a patch or provided remediation details, and the vulnerability remains unmitigated officially.

Successful exploitation can lead to remote code execution or denial of service on affected devices, compromising confidentiality, integrity, and availability. Given the remote network attack vector and lack of required user interaction, affected systems are at significant risk. The public availability of exploit code increases the likelihood of exploitation, although no active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations should consider applying network-level protections such as restricting access to the vulnerable service endpoint and monitoring for suspicious activity targeting /goform/aspForm. Avoid exposing the device to untrusted networks until an official patch is available.