Command Injection in H3C Magic NX15, NX30 Pro, NX400, and R3010 Products

CVE-2025-3543

Summary

A command injection vulnerability has been identified in H3C's Magic NX series products, specifically within the HTTP POST Request Handler's FCGI_WizardProtoProcess function. This flaw allows an attacker on the local network to exploit the vulnerable endpoint located at /api/wizard/setsyncpppoecfg, potentially leading to unauthorized command execution. It is crucial for users to apply available updates to mitigate the risks associated with this exploit.

References