CVE-2025-3543: H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injection
A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGIWizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3543?
CVE-2025-3543 is classified as a critical vulnerability.
How do I fix CVE-2025-3543?
To fix CVE-2025-3543, update the affected H3C devices to a version beyond V100R014.
What devices are affected by CVE-2025-3543?
CVE-2025-3543 affects the H3C Magic NX15, Magic NX30 Pro, Magic NX400, and Magic R3010 devices running up to V100R014.
What component is impacted by CVE-2025-3543?
CVE-2025-3543 impacts the HTTP POST Request Handler specifically in the FCGI_WizardProtoProcess function.
What type of threat does CVE-2025-3543 pose?
CVE-2025-3543 poses a significant threat as it can potentially allow unauthorized access or manipulation through the affected component.