CVE-2025-3544 | H3C Magic BE18000 up to V100R014 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injection

SecurityVulns
Yanac

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getCapabilityWeb of the component HTTP POST Request Handler. The manipulation leads to command injection.

The identification of this vulnerability is CVE-2025-3544. Access to the local network is required for this attack to succeed. Furthermore, there is an exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More