Cyber Posture

CVE-2025-2730

High

Published: 25 March 2025

Published
25 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 48.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Security Summary

CVE-2025-2730 is a critical command injection vulnerability affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers running versions up to V100R014. The issue resides in an unknown function within the /api/wizard/getssidname endpoint of the HTTP POST Request Handler component, classified under CWE-74 and CWE-77. It carries a CVSS v3.1 base score of 8.0.

Exploitation requires an attacker to be within the local network (AV:A) with low privileges (PR:L) and no user interaction (UI:N). Successful manipulation of the vulnerable endpoint enables command injection, potentially granting high-impact confidentiality, integrity, and availability compromises (C:H/I:H/A:H) on the affected device.

Advisories, including those from VulDB and H3C's software download portal, recommend upgrading the affected component to mitigate the vulnerability. The exploit has been publicly disclosed and may be in use.

The vulnerability's public disclosure increases the risk of active exploitation within local networks.

Details

CWE(s)
CWE-74CWE-77

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

Command injection in the router's HTTP API endpoint directly enables exploitation of the remote web service (T1210) and arbitrary command execution on the network device via its CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References