A critical stack-based buffer overflow vulnerability (CVE-2026-10259) has been discovered in H3C Magic B0 devices up to firmware version 100R002. The vulnerability exists in the SetMobileAPInfoById function within the /goform/aspForm file, where manipulation of the param argument leads to buffer overflow. This vulnerability can be exploited remotely and public exploits are already available. The vendor was notified but has not responded to disclosure attempts, making this a particularly concerning security issue for affected devices.