CVE-2025-3539

H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection

State: Published
Severity: 8.6 High
Published: Apr 13, 2025
Updated: Apr 14, 2025
Reserved: Apr 13, 2025

Description

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulDB
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
3.0	8.0 High	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
2.0	7.7 High	AV:A/AC:L/Au:S/C:C/I:C/A:C	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
Magic NX15H3C	V100R014Affected
Magic NX30 ProH3C	V100R014Affected
Magic NX400H3C	V100R014Affected
Magic R3010H3C	V100R014Affected
Magic BE18000H3C	V100R014Affected

References

VDB-304578 | H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injectionvdb-entrytechnical-description
VDB-304578 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #521814 | H3C H3C Magic NX30 Pro\H3C NX400\H3C NX15\H3C R3010\H3C BE18000 <=V100R014 Command Injectionthird-party-advisory
https://github.com/isstabber/my_VulnHub/blob/main/h3cNX15/nx15_command_injection.mdexploit
https://zhiliao.h3c.com/theme/details/229784related
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.