CVE-2025-2732
Published: 25 March 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2025-2732 is a critical command injection vulnerability (CVSS 3.1 score of 8.0; CWE-74, CWE-77) affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers up to version V100R014. The issue resides in an unknown functionality of the /api/wizard/getWifiNeighbour endpoint within the HTTP POST Request Handler component. Published on March 25, 2025, it allows attackers to manipulate POST requests to execute arbitrary commands.
Exploitation requires adjacency on the local network (AV:A), low attack complexity (AC:L), and low privileges (PR:L), with no user interaction needed (UI:N) and no scope change (S:U). Successful attacks can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling full system compromise such as unauthorized command execution on the targeted device.
Advisories recommend upgrading the affected component to a patched version, with software downloads available from H3C's official site. Additional details are documented in sources like VulDB (ctiid.300752) and a GitHub repository tracking H3C vulnerabilities.
The exploit has been publicly disclosed and may be actively used by attackers.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The command injection vulnerability in the HTTP POST Request Handler of the router's API endpoint directly enables exploitation of a public-facing application (T1190) to achieve arbitrary command execution on the Unix-based device (T1059.004).