Multiple Command Injection Vulnerabilities in H3C Network Devices
CVE-2025-29296

9.8CRITICAL

Key Information:

Vendor

H3C
Status
H3C Magic BE18000, H3C NX400, H3C Magic NX30 Pro, H3C Magic R3010, H3C Magic NX15, H3C Magic R1510, H3C NE36 Pro
Vendor
CVE Published:
4 August 2026

What is CVE-2025-29296?

Multiple command injection vulnerabilities exist in several H3C network devices, specifically within the /api/esps request handler. These vulnerabilities affect various functions related to VLAN management, URL filtering, system version control, and network time protocol settings. By exploiting these flaws, an attacker can manipulate user-controlled request parameters, which are incorporated into shell commands without proper validation. This can lead to arbitrary command execution with root privileges, allowing complete control over the compromised device.

References

https://www.h3c.com
https://app.notion.com/p/Multiple-Command-Injection-Vulne...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.