CVE-2025-2725
📋 TL;DR
A critical command injection vulnerability in H3C Magic router series allows attackers to execute arbitrary commands via the /api/login/auth endpoint. This affects H3C Magic NX15, NX30 Pro, NX400, R3010, and BE18000 routers up to V100R014. Attackers must be on the local network to exploit this vulnerability.
💻 Affected Systems
- H3C Magic NX15
- H3C Magic NX30 Pro
- H3C Magic NX400
- H3C Magic R3010
- H3C Magic BE18000
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise allowing attacker to intercept all network traffic, modify router configuration, install persistent backdoors, and pivot to other internal systems.
Likely Case
Router takeover enabling network reconnaissance, credential harvesting, and denial of service attacks against connected devices.
If Mitigated
Limited impact if network segmentation isolates routers and strict access controls prevent unauthorized local network access.
🎯 Exploit Status
Exploit has been publicly disclosed. Attack requires HTTP POST request manipulation to the vulnerable endpoint. No authentication bypass mentioned, suggesting exploitation may require valid credentials or other access to the login endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after V100R014
Vendor Advisory: https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
Restart Required: No
Instructions:
1. Access H3C official download portal. 2. Identify your router model. 3. Download firmware version newer than V100R014. 4. Upload firmware via web interface. 5. Apply update following vendor instructions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers from critical internal networks using VLANs or physical segmentation
Access Control
allRestrict access to router management interface to specific trusted IP addresses only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected routers from critical assets
- Deploy network monitoring and intrusion detection specifically for command injection attempts to /api/login/auth
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or SSH. If version is V100R014 or earlier, device is vulnerable.Check Version:
Check via web interface: System > Firmware Information, or via SSH: show versionVerify Fix Applied:
Verify firmware version is newer than V100R014. Test /api/login/auth endpoint with controlled command injection attempts (in safe lab environment).📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/login/auth with shell metacharacters
- Multiple failed login attempts followed by successful command execution patterns
- Router configuration changes from unexpected sources
Network Indicators:
- HTTP traffic to router management interface containing command injection patterns (semicolons, pipes, backticks)
- Outbound connections from router to unexpected external IPs
SIEM Query:
source_ip=internal AND dest_ip=router_management AND uri_path="/api/login/auth" AND (http_method="POST") AND (content CONTAINS ";" OR content CONTAINS "|" OR content CONTAINS "`")🔗 References
- https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md
- https://vuldb.com/?ctiid.300745
- https://vuldb.com/?id.300745
- https://vuldb.com/?submit.520390
- https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
- https://zhiliao.h3c.com/theme/details/229784
- https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md
