Unauthorized Access in H3C Devices Due to Insecure Default Credentials

CVE-2025-57295

What is CVE-2025-57295?

H3C devices with NX15V100R015 firmware are exposed to significant security risks due to the use of insecure default credentials. The root user account is configured without a password, while the H3C user account retains the default password 'admin', both of which are stored in the /etc/shadow file. Attackers can exploit these vulnerabilities by gaining network access and using the default credentials to access the administrative interface or other network services. This unauthorized access can lead to privilege escalation, information disclosure, and even arbitrary code execution, compromising the integrity and security of the entire network.

References