CVE-2025-2729: H3C Magic BE18000 HTTP POST Request networkSetup command injection
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
H3C Magic BE18000 HTTP POST Request Handler (/api/wizard/networkSetup)to a version that resolves this vulnerability.Fixed in V100R014 - Compensating control
Since the attack can only be done within the local network, restrict access to the affected device/HTTP POST Handler to only the local trusted network (e.g., block/limit access from untrusted networks).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2729?
CVE-2025-2729 is classified as a critical severity vulnerability.
Which products are affected by CVE-2025-2729?
CVE-2025-2729 affects H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to version V100R014.
How do I fix CVE-2025-2729?
To fix CVE-2025-2729, update the affected devices to a patched version released by H3C.
What component is impacted by CVE-2025-2729?
CVE-2025-2729 impacts the HTTP POST Request Handler of the /api/wizard/networkSetup file.
What type of vulnerability is CVE-2025-2729?
CVE-2025-2729 is a vulnerability related to improper handling of HTTP requests.