CVE-2025-2728highCWE-74CWE-77

CVE-2025-2728: falha de alta gravidade em H3C Magic NX30 Pro

H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Magic NX30 Pro+ Monitorar Magic NX400

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 1.0%
A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component.
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
H3C · Magic NX30 ProH3C · Magic NX400
CVEs relacionadas — H3C Magic NX30 Pro

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2725HIGHH3C Magic BE18000 HTTP POST Request auth command injectionEPSS 8.3%CVE-2025-3546HIGHH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.6%CVE-2025-3545HIGHH3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2025-3544HIGHH3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2025-3543HIGHH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3542HIGHH3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%