CVE-2025-2729

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2729
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.7 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 5.1 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_1.md
https://vuldb.com/?ctiid.300749
https://vuldb.com/?id.300749
https://vuldb.com/?submit.520494
Configurations

No configuration.

History

31 Mar 2025, 09:15

Type Values Removed Values Added
CVSS v2 : 9.0
v3 : 8.8 		v2 : 7.7
v3 : 8.0
Summary (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used.

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 y Magic BE18000 hasta la versión V100R014, clasificada como crítica. Este problema afecta a un procesamiento desconocido del archivo /api/wizard/networkSetup del componente HTTP POST Request Handler. La manipulación provoca la inyección de comandos. El ataque puede iniciarse remotamente. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

25 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 03:15

Updated : 2025-03-31 09:15

NVD link : CVE-2025-2729

Mitre link : CVE-2025-2729

CVE.ORG link : CVE-2025-2729

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')