Command Injection Vulnerability in H3C Magic NX15, NX30 Pro, NX400, and R3010
CVE-2025-3540

8.6HIGH

Key Information:

Vendor

H3c

Vendor
CVE Published:
13 April 2025

Badges

👾 Exploit Exists

What is CVE-2025-3540?

A command injection vulnerability exists in the FCGI_WizardProtoProcess function of the HTTP POST Request Handler in the affected H3C Magic products. Exploitation of this vulnerability requires access within the local network, potentially allowing an attacker to execute arbitrary commands. It is advisable for users to upgrade to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

Magic NX15 V100R014

Magic NX30 Pro V100R014

Magic NX400 V100R014

References

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

mono7s (VulDB User)
.