A critical, publicly exploitable buffer overflow vulnerability in IP-COM W30AP access points allows remote attackers to gain full control of the device.

The R7WebsSecurityHandler function in the /goform/wx3auth component fails to properly validate the length of the "data" argument in POST requests. This leads to a stack-based buffer overflow that can be triggered remotely by an unauthenticated attacker.

With a CVSS score of 9.8 and a public exploit available, the risk of device compromise is extreme. Attackers can gain persistent access to the network infrastructure, intercept traffic, or use the compromised access point as a pivot point for further attacks.

Immediate Action: Due to the lack of vendor response, administrators should consider replacing affected devices or placing them behind a strict firewall that blocks access to the /goform/ interface.

Proactive Monitoring: Monitor network traffic for anomalous POST requests to the /goform/wx3auth endpoint and check for unexpected reboots or configuration changes on the access points.

Compensating Controls: Disable the web management interface on the WAN side and restrict LAN-side access to trusted administrative workstations only.

Public Exploit Available: Yes

Because an exploit is public and the vendor is unresponsive, this vulnerability poses an immediate threat. We strongly recommend decommissioning affected IP-COM W30AP units or implementing stringent network isolation to prevent exploitation.