H3C R2+ProG Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in H3C R2+ProG routers running versions through 200R004. The issue arises in the HTTP POST request handler, specifically within the '/goform/aspForm' file. The vulnerability is triggered by manipulating the 'param' argument, which can lead to a crash of the device, causing a denial-of-service condition. This vulnerability can be exploited remotely, and details of the exploit are publicly available.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, leading to a crash of the affected device.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to the '/goform/aspForm' endpoint. Include a crafted 'param' argument that exploits the vulnerability, causing the device to crash.