CVE-2025-3540

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3540", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-04-13T12:27:48.961Z", "datePublished": "2025-04-13T22:31:07.248Z", "dateUpdated": "2025-04-14T18:50:15.113Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-04-13T22:31:07.248Z"}, "title": "H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "H3C", "product": "Magic NX15", "versions": [{"version": "V100R014", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}, {"vendor": "H3C", "product": "Magic NX30 Pro", "versions": [{"version": "V100R014", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}, {"vendor": "H3C", "product": "Magic NX400", "versions": [{"version": "V100R014", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}, {"vendor": "H3C", "product": "Magic R3010", "versions": [{"version": "V100R014", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component."}, {"lang": "de", "value": "In H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 bis V100R014 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es die Funktion FCGI_WizardProtoProcess der Datei /api/wizard/getCapability der Komponente HTTP POST Request Handler. Dank der Manipulation mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff im lokalen Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8, "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}}], "timeline": [{"time": "2025-04-13T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-04-13T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-04-13T14:33:02.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "mono7s (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.304579", "name": "VDB-304579 | H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.304579", "name": "VDB-304579 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.524734", "name": "Submit #524734 | H3C Technologies Co., Ltd. Magic NX30 Pro \\ Magic NX15 \\ H3C NX400 \\ H3C Magic R3010 <=V100R014 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2", "tags": ["exploit"]}, {"url": "https://zhiliao.h3c.com/theme/details/229784", "tags": ["related"]}, {"url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T18:45:09.188566Z", "id": "CVE-2025-3540", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T18:50:15.113Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3540", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-14T18:45:09.188566Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T18:49:20.630Z"}}], "cna": {"title": "H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection", "credits": [{"lang": "en", "type": "reporter", "value": "mono7s (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.7, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C"}}], "affected": [{"vendor": "H3C", "modules": ["HTTP POST Request Handler"], "product": "Magic NX15", "versions": [{"status": "affected", "version": "V100R014"}]}, {"vendor": "H3C", "modules": ["HTTP POST Request Handler"], "product": "Magic NX30 Pro", "versions": [{"status": "affected", "version": "V100R014"}]}, {"vendor": "H3C", "modules": ["HTTP POST Request Handler"], "product": "Magic NX400", "versions": [{"status": "affected", "version": "V100R014"}]}, {"vendor": "H3C", "modules": ["HTTP POST Request Handler"], "product": "Magic R3010", "versions": [{"status": "affected", "version": "V100R014"}]}], "timeline": [{"lang": "en", "time": "2025-04-13T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-04-13T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-04-13T14:33:02.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.304579", "name": "VDB-304579 | H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.304579", "name": "VDB-304579 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.524734", "name": "Submit #524734 | H3C Technologies Co., Ltd. Magic NX30 Pro \\ Magic NX15 \\ H3C NX400 \\ H3C Magic R3010 <=V100R014 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2", "tags": ["exploit"]}, {"url": "https://zhiliao.h3c.com/theme/details/229784", "tags": ["related"]}, {"url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component."}, {"lang": "de", "value": "In H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 bis V100R014 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es die Funktion FCGI_WizardProtoProcess der Datei /api/wizard/getCapability der Komponente HTTP POST Request Handler. Dank der Manipulation mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff im lokalen Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-04-13T22:31:07.248Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3540", "state": "PUBLISHED", "dateUpdated": "2025-04-14T18:50:15.113Z", "dateReserved": "2025-04-13T12:27:48.961Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-04-13T22:31:07.248Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["HTTP POST Request Handler"], "product": "Magic NX15", "vendor": "H3C", "versions": [{"status": "affected", "version": "V100R014"}]}, {"modules": ["HTTP POST Request Handler"], "product": "Magic NX30 Pro", "vendor": "H3C", "versions": [{"status": "affected", "version": "V100R014"}]}, {"modules": ["HTTP POST Request Handler"], "product": "Magic NX400", "vendor": "H3C", "versions": [{"status": "affected", "version": "V100R014"}]}, {"modules": ["HTTP POST Request Handler"], "product": "Magic R3010", "vendor": "H3C", "versions": [{"status": "affected", "version": "V100R014"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad cr\u00edtica en H3C Magic NX15, Magic NX30 Pro, Magic NX400 y Magic R3010 hasta la versi\u00f3n V100R014. Esta vulnerabilidad afecta a la funci\u00f3n FCGI_WizardProtoProcess del archivo /api/wizard/getCapability del componente HTTP POST Request Handler. La manipulaci\u00f3n provoca la inyecci\u00f3n de comandos. El ataque solo puede iniciarse dentro de la red local. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se recomienda actualizar el componente afectado."}], "id": "CVE-2025-3540", "lastModified": "2026-06-17T09:20:08.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 7.7, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3540", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-14T18:45:09.188566Z", "version": "2.0.3"}}]}, "published": "2025-04-13T23:15:12.983", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.304579"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.304579"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.524734"}, {"source": "cna@vuldb.com", "url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/"}, {"source": "cna@vuldb.com", "url": "https://zhiliao.h3c.com/theme/details/229784"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{}