H3C Magic B0 Routers Vulnerable to Remote Buffer Overflow

The National Vulnerability Database has disclosed CVE-2026-6560, a high-severity buffer overflow vulnerability impacting H3C Magic B0 routers running software version 100R002 or earlier. This flaw resides in the Edit_BasicSSID function within the /goform/aspForm file. Manipulation of a specific argument, param, triggers the buffer overflow.

This isn’t theoretical: the attack is remotely executable, and an exploit has already been publicly disclosed. The vendor, H3C, was reportedly notified prior to disclosure but has not responded. A CVSSv3.1 score of 8.8 (High) underscores the criticality, with attackers achieving high impact on confidentiality, integrity, and availability with low privileges over the network.

For defenders, this means exposed H3C Magic B0 routers are low-hanging fruit. Attackers can leverage the publicly available exploit to gain control, compromise network segments, or establish persistent access. The lack of vendor response further complicates remediation, leaving organizations to mitigate without official patches.