CVE-2026-6563 is a buffer overflow vulnerability affecting H3C Magic B1 wireless devices up to firmware version 100R004, located in the SetAPWifiorLedInfoById function of the /goform/aspForm endpoint. The vulnerability allows an authenticated remote attacker to trigger a buffer overflow through manipulation of the param argument, potentially compromising device integrity and confidentiality. This vulnerability has a CVSS score of 8.8 (HIGH), indicating significant risk with high impact across confidentiality, integrity, and availability. The attack requires network access and valid credentials but has low complexity and no user interaction needed. Exploit code has been publicly disclosed, and while the vendor was notified early, they provided no response. The vulnerability is currently listed as active on security tracking platforms with a FAUCET risk score of 51.0/100, warranting immediate patching efforts for affected deployments.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| H3C | Magic B1 | 100R004CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.