← Back

CVE-2025-3546

nvd nist
Published: Apr 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.6
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: CNA (Secondary)

Description

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Affected (5)

H3c
5 products
Magic Nx15 Firmware
Magic Nx30 Pro Firmware
Magic Nx400 Firmware
Magic R3010 Firmware
Magic Be18000 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Magic Nx15 Firmware
Up to 100r014
Running on/withPlatform Versions
H3c
Magic Nx15
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Magic Nx30 Pro Firmware
Up to 100r014
Running on/withPlatform Versions
H3c
Magic Nx30 Pro
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Magic Nx400 Firmware
Up to 100r014
Running on/withPlatform Versions
H3c
Magic Nx400
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Magic R3010 Firmware
Up to 100r014
Running on/withPlatform Versions
H3c
Magic R3010
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Magic Be18000 Firmware
Up to 100r014
Running on/withPlatform Versions
H3c
Magic Be18000
All versions

Related CWEs

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (6)

Source: cna@vuldb.com
Broken Link
Source: cna@vuldb.com
Permissions RequiredVDB Entry
Source: cna@vuldb.com
Third Party AdvisoryVDB Entry
Source: cna@vuldb.com
Third Party AdvisoryVDB Entry
Source: cna@vuldb.com
Product
Source: cna@vuldb.com
Vendor Advisory

Timeline

No history available yet.