CVE-2025-10942
Published: 25 September 2025
Summary
CVE-2025-10942 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-10942 is a buffer overflow vulnerability in H3C Magic B3 routers up to version 100R002. The flaw affects the AddMacList and EditMacList functions in the /goform/aspForm file, where manipulation of the "param" argument triggers the overflow. Associated with CWE-119 and CWE-120, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely without user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling arbitrary code execution or system crashes on affected devices. A proof-of-concept exploit is publicly available.
No official patches or mitigations have been issued, as the vendor was contacted early but did not respond. Security practitioners should review the GitHub repository at https://github.com/lin-3-start/lin-cve/blob/main/H3C%2BMagic%2BB3/H3C%20routers%20Buffer%20overflow.md (including the POC section) and VulDB entries (https://vuldb.com/?ctiid.325812, https://vuldb.com/?id.325812, https://vuldb.com/?submit.651813) for technical details and monitoring guidance.
The public exploit availability increases the risk of active use against unpatched H3C Magic B3 deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31079
Vulnerability details
A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly…
more
available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web form (/goform/aspForm) on network device enables remote exploitation for code execution or DoS without user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'param' argument in /goform/aspForm to block malformed inputs causing the buffer overflow.
Implements memory safeguards like ASLR and DEP to prevent arbitrary code execution from the buffer overflow even if triggered.
Mandates timely remediation of the identified buffer overflow flaw through patching or compensatory controls despite vendor non-response.