This vulnerability affects the LBT-T300-HW1 device from Shenzhen Libituo Technology, specifically versions 1.2.0 through 1.2.8. The issue lies in the start_single_service function within the Web Management Interface, where improper handling of the vpn_pptp_server or vpn_l2tp_server parameters can cause a buffer overflow. This flaw can be exploited remotely without user interaction and requires low attack complexity and privileges. The vendor was notified but did not provide any response or patch, leaving the vulnerability unmitigated.

Successful exploitation of this buffer overflow vulnerability could allow an attacker to execute arbitrary code remotely on the affected device, potentially leading to full compromise of the system. Given the high CVSS score and the nature of the flaw, the impact includes possible denial of service or unauthorized control over the device's functions. No known exploits are reported in the wild at this time.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users should monitor for any future vendor advisories or updates. Until a fix is released, it is recommended to restrict remote access to the Web Management Interface and avoid exposing the vulnerable services (vpn_pptp_server/vpn_l2tp_server) to untrusted networks.