CVE-2025-3854: H3C GR-3000AX HTTP POST Request aspForm Edit_List_SSID buffer overflow
First published: Tue Apr 22 2025(Updated: )
A vulnerability, which was classified as critical, was found in H3C GR-3000AX up to V100R006. Affected is the function EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit_List_SSID of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to buffer overflow. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Other functions might be affected as well.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| H3C GR-3000AX | <=V100R006 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3854?
CVE-2025-3854 is classified as a critical severity vulnerability.
What products are affected by CVE-2025-3854?
CVE-2025-3854 affects H3C GR-3000AX versions up to and including V100R006.
How do I fix CVE-2025-3854?
To fix CVE-2025-3854, you should update the H3C GR-3000AX to a version beyond V100R006.
What components are impacted by CVE-2025-3854?
CVE-2025-3854 impacts the HTTP POST Request Handler in specific functions of the device.
What type of attack does CVE-2025-3854 expose the system to?
CVE-2025-3854 can potentially allow remote code execution or unauthorized access due to improper input validation.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/h3c
- canonical/h3c gr-3000ax