CVE-2025-2726
Published: 25 March 2025
Summary
CVE-2025-2726 is a high-severity Injection (CWE-74) vulnerability in H3C Magic NX15 (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2726 is a critical command injection vulnerability affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers up to version V100R014. The issue resides in an unknown functionality of the /api/esps file within the HTTP POST Request Handler component. Classified under CWE-74 and CWE-77, it has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-25.
Exploitation requires adjacent network access (AV:A) and low privileges (PR:L), with no user interaction needed. An attacker can send a specially crafted HTTP POST request to the vulnerable endpoint, injecting arbitrary commands that execute with elevated privileges on the device. This grants high-impact confidentiality, integrity, and availability compromise, potentially allowing full device takeover.
Advisories, including those from VulDB and H3C, recommend upgrading the affected component to a patched version. The H3C software download portal provides relevant updates, and recent submissions indicate public disclosure of an exploit, increasing the urgency for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8042
Vulnerability details
A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of…
more
the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in HTTP POST handler on network device directly enables T1190 (exploiting public-facing web application) and T1059.004 (arbitrary Unix shell command execution with elevated privileges).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and patching of the command injection flaw in the HTTP POST handler of the /api/esps endpoint.
Prevents command injection exploitation by enforcing validation of untrusted inputs to the vulnerable HTTP POST request handler.
Mitigates the adjacent network access vector (AV:A) by monitoring and controlling communications to the vulnerable management interface.