Overview
A critical vulnerability, CVE-2025-3539, has recently been discovered in several products under the H3C Magic series. This vulnerability, which carries a high CVSS severity score of 8.0, affects the H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to version V100R014. Exploitation of this vulnerability could potentially lead to system compromise or data leakage, making it a significant threat to businesses and individuals using these devices.
The vulnerability lies in the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo, which is part of the HTTP POST Request Handler component. Notably, attackers can only exploit this vulnerability within a local network. Nonetheless, due to its critical level of severity and the potential impacts, it warrants urgent attention and immediate mitigation.
Vulnerability Summary
CVE ID: CVE-2025-3539
Severity: Critical (8.0)
Attack Vector: Local Network
Privileges Required: Low
User Interaction: None
Impact: System compromise or data leakage
Affected Products
No phone number, email, or personal info required.
Product | Affected Versions
H3C Magic NX15 | Up to V100R014
H3C Magic NX30 Pro | Up to V100R014
H3C Magic NX400 | Up to V100R014
H3C Magic R3010 | Up to V100R014
H3C Magic BE18000 | Up to V100R014
How the Exploit Works
The vulnerability is an instance of command injection, where an attacker can manipulate the input of the FCGI_CheckStringIfContainsSemicolon function to execute arbitrary commands as part of the HTTP POST Request. This could potentially lead to unauthorized access, system compromise, or data leakage.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. In this case, the malicious payload is sent via an HTTP POST request to the vulnerable endpoint:
POST /api/wizard/getBasicInfo HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "input": "; malicious_command" }In this example, the semicolon (;) is used to inject the malicious_command into the vulnerable function’s input, leading to command execution.
Mitigation
The best course of action to mitigate this vulnerability is to apply the vendor-provided patch. If this is not immediately possible, a temporary mitigation would be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block potential exploit attempts. However, it should be noted that these are only temporary measures and the vendor’s patch should be applied as soon as feasible.