H3C Magic B1 Buffer Overflow Vulnerability in SetAPWifiorLedInfoById Function

A buffer overflow vulnerability has been identified in the H3C Magic B1 router, affecting firmware versions through 100R004. The issue arises in the SetAPWifiorLedInfoById function within the /goform/aspForm file. The vulnerability can be exploited remotely by manipulating the 'param' argument, leading to potential denial-of-service conditions or even remote code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can disrupt normal operation or be leveraged for remote code execution.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/aspForm endpoint. The request must include a 'CMD' parameter set to 'SetMobileAPInfoById' and a 'param' field populated with a payload that exceeds the buffer length, effectively causing the overflow.