Command Injection Vulnerability in H3C Magic Products
CVE-2025-3544

8HIGH

Key Information:

Vendor
H3C Technologies Co., Ltd.
Status
H3C Magic NX15, NX30 Pro, NX400, R3010, BE18000
Vendor
CVE Published:
14 April 2025

Summary

A command injection vulnerability exists within the HTTP POST Request Handler of H3C Magic products, specifically affecting the FCGI_CheckStringIfContainsSemicolon function. This issue enables an attacker with local network access to potentially execute arbitrary commands through specially crafted HTTP requests directed to the /api/wizard/getCapabilityWeb endpoint. Given its public disclosure, it is crucial to promptly apply available upgrades to mitigate associated risks.

References

https://gist.github.com/isstabber/05dfeefa3685a369b880262...
https://vuldb.com/?ctiid.304583
https://vuldb.com/?id.304583

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.