CVE-2026-6563

HIGH

H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow

Title source: cna

Description

A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358200 | H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow

https://vuldb.com/vuln/358200

Signature, Permissions Required signature permissions-required

VDB-358200 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/358200/cti

Third Party Advisory third-party-advisory

Submit #789531 | New H3C Technologies Co., Ltd. Magic B1 Magic B1<=100R004 buffer overflow vulnerability

https://vuldb.com/submit/789531

Exploit exploit

https://github.com/K4ptor/H3C-routers-vulnerability/

View Exploit ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0048

EPSS Percentile 37.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-119 CWE-120

Status published

Products (1)

H3C/Magic B1 100R004

Published Apr 19, 2026

Tracked Since Apr 19, 2026