CVE-2025-2728highCWE-74CWE-77

CVE-2025-2728: fallo de gravedad alta en H3C Magic NX30 Pro

H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Magic NX30 Pro+ Monitorear Magic NX400

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.0%
A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
H3C · Magic NX30 ProH3C · Magic NX400
CVEs relacionadas — H3C Magic NX30 Pro

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2725HIGHH3C Magic BE18000 HTTP POST Request auth command injectionEPSS 8.3%CVE-2025-3546HIGHH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.6%CVE-2025-3545HIGHH3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2025-3544HIGHH3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2025-3543HIGHH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3542HIGHH3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%