CVE-2025-2730

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2730
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.7 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 5.1 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_2.md
https://vuldb.com/?ctiid.300750
https://vuldb.com/?id.300750
https://vuldb.com/?submit.520495
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
https://zhiliao.h3c.com/theme/details/229784
Configurations

No configuration.

History

11 Apr 2025, 20:15

Type Values Removed Values Added
References
  • () https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ -
  • () https://zhiliao.h3c.com/theme/details/229784 -
Summary (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

31 Mar 2025, 09:15

Type Values Removed Values Added
CVSS v2 : 9.0
v3 : 8.8 		v2 : 7.7
v3 : 8.0
Summary (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used.

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 y Magic BE18000 hasta la versión V100R014. Se ha clasificado como crítica. Se ve afectada una función desconocida del archivo /api/wizard/getssidname del componente HTTP POST Request Handler. La manipulación provoca la inyección de comandos. Es posible ejecutar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

25 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 03:15

Updated : 2025-04-11 20:15

NVD link : CVE-2025-2730

Mitre link : CVE-2025-2730

CVE.ORG link : CVE-2025-2730

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')