CVE-2026-3701
Remote Buffer Overflow in H3C Magic B1 Edit_BasicSSID_5G Function
Publication date: 2026-03-08
Last updated on: 2026-03-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| h3c | magic_b1_firmware | to 100r004 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3701 is a critical buffer overflow vulnerability found in the H3C Magic B1 device, specifically affecting versions up to 100R004.'}, {'type': 'paragraph', 'content': 'The flaw exists in the function Edit_BasicSSID_5G within the file /goform/aspForm. It occurs when the argument "param" is manipulated with crafted input, causing a buffer overflow because the device copies an input buffer to an output buffer without verifying that the input size is smaller than the output buffer size.'}, {'type': 'paragraph', 'content': "This vulnerability can be exploited remotely without authentication by sending a specially crafted HTTP POST request to the device's web management interface."}, {'type': 'paragraph', 'content': 'The vulnerability is classified under CWE-120 (Classic Buffer Overflow) and CWE-119.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to a buffer overflow condition on the affected device.
- Denial of Service (DoS) - the device can crash or become unresponsive.
- Potential Remote Code Execution - an attacker may execute arbitrary code remotely on the device.
Because the attack can be performed remotely without authentication, it poses a significant security risk to the confidentiality, integrity, and availability of the device.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests to the endpoint /goform/aspForm on H3C Magic B1 devices running firmware up to version 100R004.'}, {'type': 'paragraph', 'content': 'Specifically, detection involves checking for POST requests where the CMD parameter is set to Edit_BasicSSID_5G and the param field contains unusually long or crafted input that could trigger a buffer overflow.'}, {'type': 'paragraph', 'content': "A practical detection method is to capture and analyze network traffic targeting the router's web management interface, looking for suspiciously long param values in POST requests."}, {'type': 'list_item', 'content': 'Use tools like tcpdump or Wireshark to capture HTTP POST requests to /goform/aspForm.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture traffic on the router's IP (replace <router_ip>): tcpdump -A -s 0 'host <router_ip> and tcp port 80'"}, {'type': 'list_item', 'content': 'Use grep or similar tools to filter captured traffic for POST requests containing CMD=Edit_BasicSSID_5G and inspect the param parameter length.'}, {'type': 'list_item', 'content': "Example command to search in captured traffic: grep -i 'CMD=Edit_BasicSSID_5G' captured_traffic.txt"}] [2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'There are no known vendor-provided mitigations or patches for this vulnerability as the vendor did not respond to the disclosure.'}, {'type': 'paragraph', 'content': 'Immediate mitigation steps include replacing the affected H3C Magic B1 device (firmware version up to 100R004) with an alternative product that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restrict access to the router's web management interface by limiting network exposure, for example, by firewall rules or network segmentation to prevent remote exploitation."}, {'type': 'paragraph', 'content': 'Monitoring network traffic for exploit attempts and disabling remote management interfaces if not required can also reduce risk.'}] [1]