CVE-2025-2727 | THREATINT

Description

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Es wurde eine kritische Schwachstelle in H3C Magic NX30 Pro bis V100R007 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Datei /api/wizard/getNetworkStatus der Komponente HTTP POST Request Handler. Durch das Manipulieren mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann im lokalen Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

Reserved 2025-03-24 | Published 2025-03-25 | Updated 2025-04-11 | Assigner VulDB

HIGH: 8.6CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

HIGH: 8.0CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7AV:A/AC:L/Au:S/C:C/I:C/A:C

Problem types

Command Injection

Injection

Product status

V100R007

affected

Timeline

2025-03-24:	Advisory disclosed
2025-03-24:	VulDB entry created
2025-04-11:	VulDB entry last update

Credits

trunk (VulDB User) reporter

References

vuldb.com/?id.300747 (VDB-300747 | H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injection) vdb-entry technical-description

vuldb.com/?ctiid.300747 (VDB-300747 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.520394 (Submit #520394 | H3C Technologies Co., Ltd. H3C Magic NX30 Pro <=V100R007 Remote code execution) third-party-advisory

github.com/ggstrunk/CVE/blob/main/wizard_getNetworkStatus.md broken-link exploit

zhiliao.h3c.com/theme/details/229784 related

www.h3c.com/...t_Software/Software_Download/Consume_product/ patch

cve.org (CVE-2025-2727)

nvd.nist.gov (CVE-2025-2727)

Download JSON