github - ghsa-vf3h-3qcv-6864

ghsa-vf3h-3qcv-6864

Vulnerability from github

Published

2025-04-14 00:30

Modified

2025-04-14 00:30

Severity ?

8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.6 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Details

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-3540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-13T23:15:12Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.",
  "id": "GHSA-vf3h-3qcv-6864",
  "modified": "2025-04-14T00:30:35Z",
  "published": "2025-04-14T00:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3540"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.304579"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.304579"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.524734"
    },
    {
      "type": "WEB",
      "url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product"
    },
    {
      "type": "WEB",
      "url": "https://zhiliao.h3c.com/theme/details/229784"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-3540 (GCVE-0-2025-3540)

Vulnerability from cvelistv5

Published

2025-04-13 22:31

Modified

2025-04-14 18:50

Severity ?

8.6 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.0 (High) - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Summary

References

▼	URL	Tags
	https://vuldb.com/?id.304579	vdb-entry, technical-description
	https://vuldb.com/?ctiid.304579	signature, permissions-required
	https://vuldb.com/?submit.524734	third-party-advisory
	https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2	exploit
	https://zhiliao.h3c.com/theme/details/229784	related
	https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/	patch

Impacted products

Vendor

Product

Version

▼

H3C

Magic NX15

Version: V100R014

H3C	Magic NX30 Pro	Version: V100R014
H3C	Magic NX400	Version: V100R014
H3C	Magic R3010	Version: V100R014

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3540",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T18:45:09.188566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-14T18:50:15.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "Magic NX15",
          "vendor": "H3C",
          "versions": [
            {
              "status": "affected",
              "version": "V100R014"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "Magic NX30 Pro",
          "vendor": "H3C",
          "versions": [
            {
              "status": "affected",
              "version": "V100R014"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "Magic NX400",
          "vendor": "H3C",
          "versions": [
            {
              "status": "affected",
              "version": "V100R014"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "Magic R3010",
          "vendor": "H3C",
          "versions": [
            {
              "status": "affected",
              "version": "V100R014"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mono7s (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component."
        },
        {
          "lang": "de",
          "value": "In H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 bis V100R014 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es die Funktion FCGI_WizardProtoProcess der Datei /api/wizard/getCapability der Komponente HTTP POST Request Handler. Dank der Manipulation mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff im lokalen Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.7,
            "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-13T22:31:07.248Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-304579 | H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.304579"
        },
        {
          "name": "VDB-304579 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.304579"
        },
        {
          "name": "Submit #524734 | H3C Technologies Co., Ltd. Magic NX30 Pro \\  Magic NX15  \\  H3C NX400 \\  H3C Magic R3010  \u003c=V100R014  Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.524734"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://zhiliao.h3c.com/theme/details/229784"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-04-13T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-04-13T14:33:02.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-3540",
    "datePublished": "2025-04-13T22:31:07.248Z",
    "dateReserved": "2025-04-13T12:27:48.961Z",
    "dateUpdated": "2025-04-14T18:50:15.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted