CVE-2025-2725

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2725
A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.7 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 5.1 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md
https://vuldb.com/?ctiid.300745
https://vuldb.com/?id.300745
https://vuldb.com/?submit.520390
https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md
Configurations

No configuration.

History

31 Mar 2025, 09:15

Type Values Removed Values Added
CVSS v2 : 9.0
v3 : 8.8 		v2 : 7.7
v3 : 8.0
Summary (en) A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Se detectó una vulnerabilidad crítica en H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 y Magic BE18000 hasta la versión V100R014. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /api/login/auth del componente HTTP POST Request Handler. La manipulación provoca la inyección de comandos. El ataque puede ejecutarse remotamente. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

25 Mar 2025, 14:15

Type Values Removed Values Added
References () https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md - () https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md -

25 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 03:15

Updated : 2025-03-31 09:15

NVD link : CVE-2025-2725

Mitre link : CVE-2025-2725

CVE.ORG link : CVE-2025-2725

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')