Security Resilience

CVE-2025-2732

Command Injection

Command Injection
Published
25 March 2025
Modified
15 April 2026
CVSS Score v4 8.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.010 64th percentile
Risk Priority 37 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-2732 is a high-severity Injection (CWE-74) vulnerability in H3C Magic NX15 (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, ranked in the top 36% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-2732 is a critical command injection vulnerability (CVSS 3.1 score of 8.0; CWE-74, CWE-77) affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers up to version V100R014. The issue resides in an unknown functionality of the /api/wizard/getWifiNeighbour endpoint within the HTTP POST Request Handler component. Published on March 25, 2025, it allows attackers to manipulate POST requests to execute arbitrary commands.

Exploitation requires adjacency on the local network (AV:A), low attack complexity (AC:L), and low privileges (PR:L), with no user interaction needed (UI:N) and no scope change (S:U). Successful attacks can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling full system compromise such as unauthorized command execution on the targeted device.

Advisories recommend upgrading the affected component to a patched version, with software downloads available from H3C's official site. Additional details are documented in sources like VulDB (ctiid.300752) and a GitHub repository tracking H3C vulnerabilities.

The exploit has been publicly disclosed and may be actively used by attackers.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of…

more

the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

CWE(s)
CWE-74CWE-77

Related Threats

CVEs Like This One

CVE-2025-14659Shared CWE-74, CWE-77
CVE-2026-77683Shared CWE-74, CWE-77
CVE-2025-2727Shared CWE-74, CWE-77
CVE-2024-11651Shared CWE-74, CWE-77
CVE-2026-2218Shared CWE-74, CWE-77
CVE-2026-1419Shared CWE-74, CWE-77
CVE-2025-7836Shared CWE-74, CWE-77
CVE-2026-12808Shared CWE-74, CWE-77
CVE-2025-3543Shared CWE-74, CWE-77
CVE-2026-1596Shared CWE-74, CWE-77

Affected Assets

H3C
Magic NX15
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover command-construction flaws before deployment.

SI-10 Information Input Validation good match

SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles include proper neutralization and safe command construction practices.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches injection vulnerabilities before release.

A.8.16 Monitoring activities partial match
finds

Monitoring activities can identify active injection attacks after they occur.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper neutralization of special elements, directly addressing CWE-74.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-74, a class-level weakness, and none of its children carries one either.
  • No fine-grained STIG row for CWE-77, a class-level weakness, and none of its children carries one either.

References