CVE - CVE-2025-3542

CVE-ID
CVE-2025-3542	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:Submit #524738 \| H3C Technologies Co., Ltd. H3C Magic NX30 Pro \ Magic NX15 \ H3C NX400 \ H3C Magic R3010 <=V100R014 Command Injection URL:https://vuldb.com/?submit.524738 MISC:VDB-304581 \| CTI Indicators (IOB, IOC, TTP, IOA) URL:https://vuldb.com/?ctiid.304581 MISC:VDB-304581 \| H3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injection URL:https://vuldb.com/?id.304581 MISC:https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5d URL:https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5d MISC:https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ URL:https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ MISC:https://zhiliao.h3c.com/theme/details/229784 URL:https://zhiliao.h3c.com/theme/details/229784
Assigning CNA
VulDB
Date Record Created
20250413	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250413)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)