CVE-2025-3540 - H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection

Back Back to CVE browser

HIGH

H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection

Published Apr 13, 2025

8.6

HIGH

CVSS 4.0

EPSS 1.06%

Description

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Affected products

Vendor H3C Product Magic NX15 Default
n/a
- Version
  V100R014
  Status
  affected
  Constraints
  -
Vendor H3C Product Magic NX30 Pro Default
n/a
- Version
  V100R014
  Status
  affected
  Constraints
  -
Vendor H3C Product Magic NX400 Default
n/a
- Version
  V100R014
  Status
  affected
  Constraints
  -
Vendor H3C Product Magic R3010 Default
n/a
- Version
  V100R014
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

H3C

Magic NX15

n/a

Version	Status	Constraints
V100R014	affected	-

H3C

Magic NX30 Pro

n/a

Version	Status	Constraints
V100R014	affected	-

H3C

Magic NX400

n/a

Version	Status	Constraints
V100R014	affected	-

H3C

Magic R3010

n/a

Version	Status	Constraints
V100R014	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-77

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10854
Advisory
https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2
exploit
https://vuldb.com/?ctiid.304579
signaturepermissions-required
https://vuldb.com/?id.304579
vdb-entrytechnical-description
https://vuldb.com/?submit.524734
third-party-advisory
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
patch
https://zhiliao.h3c.com/theme/details/229784
related

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10854		Advisory
https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2		exploit
https://vuldb.com/?ctiid.304579		signaturepermissions-required
https://vuldb.com/?id.304579		vdb-entrytechnical-description
https://vuldb.com/?submit.524734		third-party-advisory
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/		patch
https://zhiliao.h3c.com/theme/details/229784		related