Executive brief
A security vulnerability exists in the H3C Magic B3 router, a device used to provide internet connectivity and network management. An attacker with administrative access can send a specially crafted request to the router's management interface to cause a system crash or potentially take full control of the device. This could lead to a total loss of internet service for the connected network or unauthorized access to network traffic.
Technical details
A stack-based buffer overflow vulnerability exists in the H3C Magic B3 router (firmware up to 100R002) within the 'UpdateWanParams' function of the '/goform/aspForm' interface. The root cause is an inconsistency between input validation and memory allocation: while the 'param' argument is restricted to 512 bytes, the subsequent copy operation targets a destination buffer of only 64 bytes without further bounds checking. An attacker with high privileges (authenticated administrator) can exploit this via a crafted POST request to overwrite adjacent memory. This can result in a crash of the web management service, a device reboot (DoS), or potentially remote code execution (RCE). As of the advisory date, the vendor has not responded to disclosure efforts, and no official patch is available.
Affected products
- H3C Magic B3 up to 100R002
Timeline
- 2026-04-23: disclosed: Vulnerability details and PoC published on GitHub
- 2026-05-17: advisory: CVE-2026-8764 published by VulDB/NVD