CVE-2025-3542
highpriority · track · 0EPSS 0.011 · 64 %ileEUEPSS · scored 2026-10-27
A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.1–8.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-3542cnnvd
- https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5dcnnvd
- https://vuldb.com/?ctiid.304581cnnvd
- https://vuldb.com/?id.304581cnnvd
- https://vuldb.com/?submit.524738cnnvd
- https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/cnnvd
- https://zhiliao.h3c.com/theme/details/229784cnnvd
- https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5denisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan