This vulnerability in H3C Magic B3 (up to version 100R002) involves a buffer overflow in the UpdateWanParams function within /goform/aspForm. An attacker with high privileges can remotely manipulate the 'param' argument to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required for attack initiation, and high impact on confidentiality, integrity, and availability. The vendor has not issued any fix or advisory, and no patch links are available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary code or disrupt the affected device's operation remotely. The vulnerability impacts confidentiality, integrity, and availability of the device. Although the exploit code has been publicly disclosed, no active exploitation in the wild has been reported. The lack of vendor response and patch increases the risk for affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been provided by the vendor, users should consider limiting network exposure of affected devices, restrict access to trusted administrators only, and monitor for unusual activity related to the UpdateWanParams function. Stay alert for any future vendor advisories or patches addressing this issue.