CVE-2026-10259: H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow

Synopsis

A stack-based buffer overflow exists in the H3C Magic B0 router (firmware up to 100R002) within the SetMobileAPInfoById function, reachable via the /goform/aspForm endpoint over the network. An attacker with a low-privilege account can send a crafted request with a malformed param argument to trigger the overflow. Successful exploitation gives the attacker full control over the device, including the ability to read credentials, modify configuration, and crash or take over the router process. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable /goform/aspForm endpoint is exposed over the network, so the attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account is sufficient to send the malformed request that triggers the overflow.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no action by a user or administrator on the target device is needed.

• Attack complexityDetail

  AC:L and AT:N indicate the exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental prerequisites.

Blast Radius

• Reads sensitive data stored on the device, including wireless credentials, session tokens, and administrative configuration.
• Modifies device configuration, such as DNS settings, access-control rules, or mobile AP parameters, enabling traffic interception or redirection.
• Crashes the affected router process or causes a full device reboot, disrupting network connectivity for all clients behind the device.
• With full stack control, an attacker can execute arbitrary code on the device at the privilege level of the web server process, effectively owning the hardware.