---
id: CVE-2025-14196
title: A weakness has been identified in H3C Magic B1 up to 100R004
summary: >-
  A weakness has been identified in H3C Magic B1 up to 100R004. The affected
  element is the function sub_44de0 of the file /goform/aspForm. This
  manipulation of the argument param causes buffer overflow. Remote exploitation
  of the attack i…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-120
published: '2025-12-07'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14196'
references:
  - url: >-
      https://github.com/lin-3-start/lin-cve/blob/main/H3C%20Magic%20B1/H3C%20Magic%20B1.md
    label: cna@vuldb.com
  - url: >-
      https://github.com/lin-3-start/lin-cve/blob/main/H3C%20Magic%20B1/H3C%20Magic%20B1.md#poc
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.334616'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.334616'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.699387'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00529
epssPercentile: 0.43369
ingestedAt: '2026-10-14T23:00:02.010Z'
---

## Overview

A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub_44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.