This vulnerability involves a buffer overflow in the start_single_service function of the Web Management Interface component in Shenzhen Libituo Technology's LBT-T300-HW1 device (versions 1.2.0 through 1.2.8). Remote attackers can exploit this by manipulating the vpn_pptp_server or vpn_l2tp_server parameters, potentially leading to memory corruption. The vendor has not provided any response or patch, and no official remediation level is assigned. The CVSS 4.0 score of 8.7 reflects a high-severity issue with low attack complexity and no required privileges or user interaction.

Successful exploitation of this buffer overflow could allow remote attackers to cause memory corruption, potentially leading to denial of service or arbitrary code execution on the affected device. Given the high CVSS score and the remote attack vector, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the device. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the Web Management Interface from untrusted networks as a temporary mitigation. Monitor for any future vendor advisories or patches addressing this vulnerability.