This vulnerability involves a buffer overflow in the start_lan function of the /apply.cgi file in Shenzhen Libituo Technology's LBT-T300-HW1 device firmware versions 1.2.0 through 1.2.8. The issue arises from improper validation of the Channel/ApCliSsid argument, which can be manipulated remotely to overflow a buffer. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided a patch or remediation, and the exploit code has been publicly disclosed.

Successful exploitation of this buffer overflow vulnerability can allow an attacker to execute arbitrary code remotely on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. Given the remote attack vector and lack of required user interaction, this poses a significant risk to affected systems. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider limiting network exposure of the affected device and monitor for any updates from the vendor. Avoid exposing the device's management interface to untrusted networks until a patch or official mitigation is released.