CVE-2026-6581

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-658107.8Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-658118.8Improper input validation in Power BI allows an authorized attacker to execute code over a network.CVE-2026-658126.8Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over CVE-2026-658138.8Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-658147.8Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-658158.8Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.CVE-2026-6581610.0Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-658189.9Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.CVE-2026-658197.5gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, cou CVE-2026-65827.3A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file CVE-2026-658227.6ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customer CVE-2026-658247.4OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attac