CVE-2025-8907 - H3C M2 NAS Webserver Configuration unnecessary privileges

Back Back to CVE browser

HIGH

H3C M2 NAS Webserver Configuration unnecessary privileges

Published Aug 13, 2025

7.3

HIGH

CVSS 4.0

EPSS 0.16%

Description

A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he device only has configuration files and does not actually have boa functionality. It is impossible to access or upload files anonymously to the device through boa services". This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

Vendor H3C Product M2 NAS Default
n/a
- Version
  V100R006
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

H3C

M2 NAS

n/a

Version	Status	Constraints
V100R006	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-250

Execution with Unnecessary Privileges

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24564
Advisory
https://vuldb.com/?ctiid.319861
signaturepermissions-required
https://vuldb.com/?id.319861
vdb-entry
https://vuldb.com/?submit.624554
third-party-advisory
https://www.notion.so/23f54a1113e7804bae88e76f9fb0cf5b
exploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24564		Advisory
https://vuldb.com/?ctiid.319861		signaturepermissions-required
https://vuldb.com/?id.319861		vdb-entry
https://vuldb.com/?submit.624554		third-party-advisory
https://www.notion.so/23f54a1113e7804bae88e76f9fb0cf5b		exploit