CVE-2025-2730

High

Published: 25 March 2025

Published

25 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.6 CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0033 56.3th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2730 is a high-severity Injection (CWE-74) vulnerability in H3C Magic NX15 (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 43.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-2730 is a critical command injection vulnerability affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers running versions up to V100R014. The issue resides in an unknown function within the /api/wizard/getssidname endpoint of the HTTP POST Request Handler component, classified under CWE-74 and CWE-77. It carries a CVSS v3.1 base score of 8.0.

Exploitation requires an attacker to be within the local network (AV:A) with low privileges (PR:L) and no user interaction (UI:N). Successful manipulation of the vulnerable endpoint enables command injection, potentially granting high-impact confidentiality, integrity, and availability compromises (C:H/I:H/A:H) on the affected device.

Advisories, including those from VulDB and H3C's software download portal, recommend upgrading the affected component to mitigate the vulnerability. The exploit has been publicly disclosed and may be in use.

The vulnerability's public disclosure increases the risk of active exploitation within local networks.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8045

Vulnerability details

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP…

POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CWE(s): CWE-74 CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1059.008 Network Device CLI Execution

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

attack.mitre.org →

Why these techniques?

Command injection in the router's HTTP API endpoint directly enables exploitation of the remote web service (T1210) and arbitrary command execution on the network device via its CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0