CVE-2025-2728

H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injection

State: Published
Severity: 8.6 High
Published: Mar 25, 2025
Updated: Apr 11, 2025
Reserved: Mar 24, 2025

Description

A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulDB
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
3.0	8.0 High	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
2.0	7.7 High	AV:A/AC:L/Au:S/C:C/I:C/A:C	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
Magic NX30 ProH3C	V100R014Affected
Magic NX400H3C	V100R014Affected

References

VDB-300748 | H3C Magic NX30 Pro/Magic NX400 getNetworkConf command injectionvdb-entrytechnical-description
VDB-300748 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #520462 | H3C Technologies Co., Ltd. H3C Magic NX30 Pro\H3C NX400 <=V100R014 Remote command executionthird-party-advisory
https://github.com/RK1Y8/cve_cve/blob/main/h3c.mdbroken-link
https://zhiliao.h3c.com/theme/details/229784related
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.