This vulnerability in H3C Magic B3 (up to 100R002) involves a buffer overflow in the UpdateWanParams function of the /goform/aspForm endpoint. An attacker with high privileges can remotely manipulate the 'param' argument to cause a buffer overflow condition. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required for attack initiation, and no user interaction needed. The vendor has not provided any patch or mitigation guidance, and the exploit code has been publicly disclosed.

Successful exploitation could allow an attacker to cause a buffer overflow remotely, potentially leading to denial of service or arbitrary code execution depending on the device's handling of the overflow. Given the high CVSS score and remote attack vector, this poses a significant risk to affected devices. However, no confirmed exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates. Until a patch is released, restricting network access to the vulnerable service and limiting privileges may reduce exposure.