Command Injection Vulnerability in H3C Magic NX15, NX30 Pro, NX400, and R3010
CVE-2025-3541

8HIGH

Key Information:

Vendor
H3C Technologies Co., Ltd.
Status
H3C Magic Series
Vendor
CVE Published:
13 April 2025

Summary

A command injection vulnerability exists in the FCGI_WizardProtoProcess function of the /api/wizard/getSpecs file in H3C Magic NX15, NX30 Pro, NX400, and R3010 products. This vulnerability, which is exploitable through HTTP POST requests, allows attackers within the local network to execute arbitrary commands on the affected devices. It is advised for users to upgrade their systems to the latest versions to mitigate potential risks.

References

https://gist.github.com/mono7s/fcbc1f02d69547704cc9027b29...
https://vuldb.com/?ctiid.304580
https://vuldb.com/?id.304580

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.