Hard-Coded Weak Password Vulnerability in H3C Magic Devices

CVE-2025-61330

What is CVE-2025-61330?

A vulnerability has been identified in all H3C Magic-branded devices, wherein a hard-coded weak password is used for the root account, potentially leaving them susceptible to unauthorized access. Many of these devices ship with the Telnet service enabled by default or allow users to activate it through various management interfaces. Furthermore, the presence of Virtual Servers can expose these devices to the public network. This configuration can enable attackers to leverage the weak credentials to gain root privileges, facilitating remote control and various malicious activities.

References