CVE-2025-2727

H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injection

CVSS 8.6 HIGHEPSS 1.1%CWE-74 CWE-77

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.6EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

25 mar 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

H3C · Magic NX30 Pro

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/ggstrunk/CVE/blob/main/wizard_getNetworkStatus.md https://vuldb.com/?ctiid.300747 https://vuldb.com/?id.300747 https://vuldb.com/?submit.520394 https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/https://zhiliao.h3c.com/theme/details/229784