CVE-2025-2731

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2731
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.7 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 5.1 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md
https://vuldb.com/?ctiid.300751
https://vuldb.com/?id.300751
https://vuldb.com/?submit.520497
https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md
Configurations

No configuration.

History

31 Mar 2025, 09:15

Type Values Removed Values Added
CVSS v2 : 9.0
v3 : 8.8 		v2 : 7.7
v3 : 8.0
Summary (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 y Magic BE18000 hasta la versión V100R014. Se ha declarado crítica. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /api/wizard/getDualbandSync del componente HTTP POST Request Handler. La manipulación provoca la inyección de comandos. El ataque puede ejecutarse remotamente. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

25 Mar 2025, 14:15

Type Values Removed Values Added
References () https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md - () https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md -

25 Mar 2025, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-25 04:15

Updated : 2025-03-31 09:15

NVD link : CVE-2025-2731

Mitre link : CVE-2025-2731

CVE.ORG link : CVE-2025-2731

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')