CVE-2025-2726
Published: 25 March 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2025-2726 is a critical command injection vulnerability affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers up to version V100R014. The issue resides in an unknown functionality of the /api/esps file within the HTTP POST Request Handler component. Classified under CWE-74 and CWE-77, it has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-25.
Exploitation requires adjacent network access (AV:A) and low privileges (PR:L), with no user interaction needed. An attacker can send a specially crafted HTTP POST request to the vulnerable endpoint, injecting arbitrary commands that execute with elevated privileges on the device. This grants high-impact confidentiality, integrity, and availability compromise, potentially allowing full device takeover.
Advisories, including those from VulDB and H3C, recommend upgrading the affected component to a patched version. The H3C software download portal provides relevant updates, and recent submissions indicate public disclosure of an exploit, increasing the urgency for mitigation.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Command injection in HTTP POST handler on network device directly enables T1190 (exploiting public-facing web application) and T1059.004 (arbitrary Unix shell command execution with elevated privileges).