CVE-2025-60262
Published: 06 January 2026
Description
An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and…
more
remote attackers could gain root-level control over the devices.
Mitigating Controls (NIST 800-53 r5)AI
CM-6 directly mitigates the vsftpd misconfiguration by requiring secure configuration settings that prevent anonymous FTP uploads from creating root-owned files.
CM-7 enforces least functionality by prohibiting or restricting unnecessary anonymous FTP services on affected H3C devices.
AC-14 limits permitted actions without identification or authentication, preventing anonymous FTP uploads that gain root ownership and enable remote control.
Security SummaryAI
CVE-2025-60262 is a misconfiguration vulnerability in the vsftpd FTP service on H3C M102G HM1A0V200R010 wireless controllers and BA1500L SWBA1A0V100R006 wireless access points. Published on 2026-01-06, it stems from CWE-276 (Incorrect Default Permissions), where files uploaded anonymously via FTP are automatically owned by the root user. This flaw has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.
Remote attackers can exploit this vulnerability without authentication by connecting to the FTP service and uploading malicious files anonymously. Since these files gain root ownership, attackers can achieve full root-level control over the affected devices, potentially enabling arbitrary code execution, persistence, or further network compromise.
Mitigation details are outlined in advisories referenced at https://www.notion.so/23e54a1113e780d686fbe1624ee0465d and https://www.notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote attackers to upload files via public-facing FTP service (T1190, T1210) that gain root ownership due to incorrect default permissions (T1044), enabling root-level arbitrary code execution.