CVE-2025-57295: High severity H3C H3C Firmware vulnerability
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57295?
CVE-2025-57295 has a high severity because it allows unauthorized access to H3C devices due to insecure default credentials.
How do I fix CVE-2025-57295?
To fix CVE-2025-57295, change the default password for the H3C user account and set a password for the root user account immediately.
Which devices are affected by CVE-2025-57295?
CVE-2025-57295 affects H3C devices running firmware version NX15V100R015.
What type of attack can be executed due to CVE-2025-57295?
CVE-2025-57295 allows attackers with network access to exploit the vulnerability and gain unauthorized access to H3C devices.
Is there a workaround for CVE-2025-57295?
The only effective workaround for CVE-2025-57295 is to change the insecure default credentials to strong, unique passwords.