CVE-2025-2731: H3C Magic BE18000 HTTP POST Request getDualbandSync command injection
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2731?
CVE-2025-2731 has been declared as critical due to its potential impact.
What components are affected by CVE-2025-2731?
CVE-2025-2731 affects the H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to version V100R014.
How can I mitigate CVE-2025-2731?
Mitigation for CVE-2025-2731 involves updating to the latest firmware version that resolves the vulnerability.
What is the nature of the vulnerability in CVE-2025-2731?
CVE-2025-2731 involves an unknown functionality of the file /api/wizard/getDualbandSync related to HTTP POST requests.
Are there any known exploits for CVE-2025-2731?
As of now, specific exploits for CVE-2025-2731 have not been publicly reported.