This vulnerability affects the LBT-T300-HW1 device firmware versions 1.2.0 through 1.2.8 by allowing a remote attacker to cause a buffer overflow via manipulation of the Channel/ApCliSsid parameter in the start_lan function of /apply.cgi. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high severity. The vendor has not issued any fix or advisory, and no patch links are available. The exploit code has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation of this buffer overflow can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. The vulnerability can be triggered remotely without user interaction and requires low privileges, making it a significant risk for affected devices. No known exploits are currently observed in the wild, but public disclosure increases the likelihood of future attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded to disclosure and no official fix is available at this time. Until a patch is released, affected users should consider network-level mitigations such as restricting access to the device's management interface from untrusted networks. Monitor for updates from the vendor regarding patches or official mitigations.