CVE-2025-14015
Published: 04 December 2025
Summary
CVE-2025-14015 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in H3C Magic B0 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the buffer overflow vulnerability in H3C Magic B0 via patching, mitigations, or replacement since no vendor fix is available.
Scans organizational systems to identify vulnerable H3C Magic B0 devices up to 100R002 affected by CVE-2025-14015 for prioritized action.
Blocks unauthorized remote network access to the vulnerable /goform/aspForm management endpoint, countering the AV:N exploitation vector.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing web management interface (/goform/aspForm EditWlanMacList) of H3C Magic B0 router enables remote code execution for initial access (T1190) and denial of service through application exploitation (T1499.004).
NVD Description
A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has…
more
been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-14015 is a buffer overflow vulnerability affecting H3C Magic B0 devices up to version 100R002. The issue resides in the EditWlanMacList function within the /goform/aspForm file, where manipulation of the "param" argument triggers the overflow. This flaw, linked to CWE-119 and CWE-120, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows high-impact consequences, including unauthorized access to confidential data, modification of system integrity, and disruption of availability, potentially leading to remote code execution on the affected device.
Advisories from VulDB note that the exploit is publicly available on GitHub, and the vendor was contacted early but provided no response or patch. No official mitigation or firmware update is referenced, leaving affected systems reliant on network segmentation, access controls, or device replacement to reduce exposure.
The public disclosure of the exploit code heightens the risk of widespread targeting, particularly for unpatched H3C Magic B0 deployments in enterprise networks.
Details
- CWE(s)