CVE-2025-3539 | H3C Magic BE18000 up to V100R014 HTTP POST Request /api/wizard/getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection

April 13, 2025 Yanac

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The manipulation leads to command injection.

This vulnerability is traded as CVE-2025-3539. The attack can only be done within the local network. Furthermore, there is an exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More