CVE-2025-3546

{"id": "CVE-2025-3546", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 7.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-14T02:15:13.333", "references": [{"url": "https://gist.github.com/isstabber/154661f329e4ae6bfe15dcdc0b932ff3", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.304585", "tags": ["Permissions Required", "VDB Entry"], "source": "[email protected]"}, {"url": "https://vuldb.com/?id.304585", "tags": ["Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.524745", "tags": ["Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://zhiliao.h3c.com/theme/details/229784", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 y Magic BE18000 hasta la versi\u00f3n V100R014. Se ha declarado cr\u00edtica. Esta vulnerabilidad afecta a la funci\u00f3n FCGI_CheckStringIfContainsSemicolon del archivo /api/wizard/getLanguage del componente HTTP POST Request Handler. La manipulaci\u00f3n provoca la inyecci\u00f3n de comandos. El ataque solo puede realizarse dentro de la red local. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se recomienda actualizar el componente afectado."}], "lastModified": "2026-02-13T21:47:58.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D77C9B25-3C77-4762-8274-5D41B08B615C", "versionEndIncluding": "100r014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:h3c:magic_nx15:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "93D19A70-0177-4778-8DE1-31BBC29D6A20"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:h3c:magic_nx30_pro_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "973B8E41-BA21-44C1-9589-35A55DA8FD06", "versionEndIncluding": "100r014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:h3c:magic_nx30_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7B80A078-A8E2-4CE4-81C9-3798FB4033F3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:h3c:magic_nx400_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E48FBBE-C01E-4EF6-B036-713730E01CF7", "versionEndIncluding": "100r014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:h3c:magic_nx400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A0C53484-D57B-47AE-A882-44882EEDB08E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:h3c:magic_r3010_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "840C5360-4A71-4E44-BFB9-8E08B7B56470", "versionEndIncluding": "100r014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:h3c:magic_r3010:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8FE48F6B-93CD-44FD-AF62-B1E75E9132E4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:h3c:magic_be18000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C8468A7-C3FB-4A99-AD92-9B33442DE56C", "versionEndIncluding": "100r014"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:h3c:magic_be18000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8FA7990-D35A-455C-A443-EBAFB395B6ED"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}