CVE-2025-2727

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2727
A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.7 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 5.1 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/ggstrunk/CVE/blob/main/wizard_getNetworkStatus.md
https://vuldb.com/?ctiid.300747
https://vuldb.com/?id.300747
https://vuldb.com/?submit.520394
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
https://zhiliao.h3c.com/theme/details/229784
Configurations

No configuration.

History

11 Apr 2025, 20:15

Type Values Removed Values Added
Summary (en) A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. (en) A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
References
  • () https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ -
  • () https://zhiliao.h3c.com/theme/details/229784 -

31 Mar 2025, 09:15

Type Values Removed Values Added
CVSS v2 : 9.0
v3 : 8.8 		v2 : 7.7
v3 : 8.0
Summary (en) A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Se detectó una vulnerabilidad crítica en H3C Magic NX30 Pro hasta la versión V100R007. Esta vulnerabilidad afecta a una parte desconocida del archivo /api/wizard/getNetworkStatus del componente HTTP POST Request Handler. La manipulación provoca la inyección de comandos. Es posible iniciar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta vulnerabilidad, pero no respondió.

25 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 03:15

Updated : 2025-04-11 20:15

NVD link : CVE-2025-2727

Mitre link : CVE-2025-2727

CVE.ORG link : CVE-2025-2727

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')