CVE - CVE-2025-3543

CVE-ID
CVE-2025-3543	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGI_WizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:Submit #524739 \| H3C Technologies Co., Ltd. H3C Magic NX30 Pro \ Magic NX15 \ H3C NX400 \ H3C Magic R3010 <=V100R014 Command Injection URL:https://vuldb.com/?submit.524739 MISC:VDB-304582 \| CTI Indicators (IOB, IOC, TTP, IOA) URL:https://vuldb.com/?ctiid.304582 MISC:VDB-304582 \| H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injection URL:https://vuldb.com/?id.304582 MISC:https://gist.github.com/mono7s/9369a3ef060b5655303cd234ba583bb5 URL:https://gist.github.com/mono7s/9369a3ef060b5655303cd234ba583bb5 MISC:https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ URL:https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/ MISC:https://zhiliao.h3c.com/theme/details/229784 URL:https://zhiliao.h3c.com/theme/details/229784
Assigning CNA
VulDB
Date Record Created
20250413	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250413)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)