{"id":34304,"date":"2025-05-03T12:53:09","date_gmt":"2025-05-03T12:53:09","guid":{"rendered":""},"modified":"2025-05-14T05:21:00","modified_gmt":"2025-05-14T05:21:00","slug":"cve-2025-3539-command-injection-vulnerability-in-h3c-magic-devices","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-3539-command-injection-vulnerability-in-h3c-magic-devices\/","title":{"rendered":"CVE-2025-3539: Command Injection Vulnerability in H3C Magic Devices<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

A critical vulnerability, CVE-2025-3539, has recently been discovered in several products under the H3C Magic series. This vulnerability, which carries a high CVSS severity score of 8.0, affects the H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to version V100R014. Exploitation of this vulnerability could potentially lead to system compromise or data<\/a> leakage, making it a significant threat to businesses and individuals using these devices.
\nThe vulnerability lies in the function FCGI_CheckStringIfContainsSemicolon of the file<\/a> \/api\/wizard\/getBasicInfo, which is part of the HTTP POST Request Handler component. Notably, attackers can only exploit this vulnerability within a local<\/a> network. Nonetheless, due to its critical level of severity and the potential<\/a> impacts, it warrants urgent attention and immediate mitigation.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-3539
\nSeverity: Critical (8.0)
\nAttack Vector: Local Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: System compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

H3C Magic<\/a> NX15 | Up to V100R014
\nH3C Magic<\/a> NX30 Pro | Up to V100R014
\nH3C Magic<\/a> NX400 | Up to V100R014
\nH3C Magic<\/a> R3010 | Up to V100R014
\nH3C Magic<\/a> BE18000 | Up to V100R014<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability is an instance of command injection<\/a>, where an attacker can manipulate the input of the FCGI_CheckStringIfContainsSemicolon function to execute arbitrary commands as part of the HTTP POST Request. This could potentially lead<\/a> to unauthorized access, system compromise, or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how the vulnerability might be exploited<\/a>. In this case, the malicious payload is sent via an HTTP POST request to the vulnerable<\/a> endpoint:<\/p>\n

POST \/api\/wizard\/getBasicInfo HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"input\": \"; malicious_command\" }<\/code><\/pre>\n
In this example, the semicolon (;) is used to inject the malicious_command into the vulnerable<\/a> function’s input, leading to command execution.<\/p>\n
Mitigation<\/strong><\/p>\n
The best course of action to mitigate this vulnerability<\/a> is to apply the vendor-provided patch. If this is not immediately possible, a temporary mitigation would be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block potential exploit attempts. However, it should be noted that these are only temporary measures and the vendor’s patch should be applied as soon as feasible.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview A critical vulnerability, CVE-2025-3539, has recently been discovered in several products under the H3C Magic series. This vulnerability, which carries a high CVSS severity score of 8.0, affects the H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to version V100R014. Exploitation of this vulnerability could potentially lead to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[78,80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-34304","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-injection","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t