This vulnerability involves a buffer overflow in the SetMobileAPInfoById function of the H3C Magic B1 device firmware (up to version 100R004). The issue arises from improper handling of an argument parameter in the /goform/aspForm endpoint, allowing remote attackers to cause a buffer overflow. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not provided a patch or official remediation, and exploit code is publicly accessible, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to a buffer overflow condition on the affected device, which may allow remote attackers to execute arbitrary code or cause denial of service. Given the high CVSS score and the availability of public exploits, affected devices are at significant risk if exposed to untrusted networks.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should consider implementing network-level protections such as restricting access to the affected device's management interfaces and monitoring for suspicious activity related to the /goform/aspForm endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.