Security Resilience

CVE-2025-2727

Command Injection

Command Injection
Published
25 March 2025
Modified
15 April 2026
CVSS Score v4 8.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.010 64th percentile
Risk Priority 37 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-2727 is a high-severity Injection (CWE-74) vulnerability in H3C Magic NX30 (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, ranked in the top 36% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-2727 is a critical command injection vulnerability affecting H3C Magic NX30 Pro routers up to version V100R007. The issue resides in an unknown part of the /api/wizard/getNetworkStatus endpoint within the HTTP POST Request Handler component. Successful exploitation allows arbitrary command execution, as classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection). The vulnerability carries a CVSS v3.1 base score of 8.0.

Exploitation requires adjacent network access (AV:A), low attack complexity (AC:L), and low privileges (PR:L), with no user interaction needed (UI:N). An attacker with local network proximity and minimal authentication can send a crafted HTTP POST request to the vulnerable endpoint, injecting and executing arbitrary operating system commands on the device. This grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

Advisories recommend upgrading the affected component to a patched version, as noted in the vulnerability description and linked H3C software download portal. Additional details are available via VulDB entries and a public GitHub disclosure containing the exploit.

The exploit has been publicly disclosed and may be actively used by attackers.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access…

more

to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CWE(s)
CWE-74CWE-77

Related Threats

CVEs Like This One

CVE-2025-14659Shared CWE-74, CWE-77
CVE-2026-77683Shared CWE-74, CWE-77
CVE-2024-11651Shared CWE-74, CWE-77
CVE-2026-2218Shared CWE-74, CWE-77
CVE-2026-1419Shared CWE-74, CWE-77
CVE-2025-7836Shared CWE-74, CWE-77
CVE-2026-12808Shared CWE-74, CWE-77
CVE-2025-3543Shared CWE-74, CWE-77
CVE-2026-1596Shared CWE-74, CWE-77
CVE-2025-11523Shared CWE-74, CWE-77

Affected Assets

H3C
Magic NX30
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover command-construction flaws before deployment.

SI-10 Information Input Validation good match

SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles include proper neutralization and safe command construction practices.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches injection vulnerabilities before release.

A.8.16 Monitoring activities partial match
finds

Monitoring activities can identify active injection attacks after they occur.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements, directly addressing CWE-74.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-74, a class-level weakness, and none of its children carries one either.
  • No fine-grained STIG row for CWE-77, a class-level weakness, and none of its children carries one either.

References