Command Injection Vulnerability in H3C Magic NX15 and NX400 Devices

CVE-2025-3542

Summary

A command injection vulnerability has been identified in the HTTP POST Request Handler of the affected H3C Magic devices. Specifically, the flaw resides in the FCGI_WizardProtoProcess function within the /api/wizard/getsyncpppoecfg file. This vulnerability allows an attacker to execute arbitrary commands if they are within the local network. Given that the exploit has been made public, it is crucial for users to upgrade their affected devices to mitigate the risks associated with this vulnerability.

References