CVE-2025-2732
Published: 25 March 2025
Summary
CVE-2025-2732 is a high-severity Injection (CWE-74) vulnerability in H3C Magic NX15 (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-2732 is a critical command injection vulnerability (CVSS 3.1 score of 8.0; CWE-74, CWE-77) affecting H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 routers up to version V100R014. The issue resides in an unknown functionality of the /api/wizard/getWifiNeighbour endpoint within the HTTP POST Request Handler component. Published on March 25, 2025, it allows attackers to manipulate POST requests to execute arbitrary commands.
Exploitation requires adjacency on the local network (AV:A), low attack complexity (AC:L), and low privileges (PR:L), with no user interaction needed (UI:N) and no scope change (S:U). Successful attacks can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling full system compromise such as unauthorized command execution on the targeted device.
Advisories recommend upgrading the affected component to a patched version, with software downloads available from H3C's official site. Additional details are documented in sources like VulDB (ctiid.300752) and a GitHub repository tracking H3C vulnerabilities.
The exploit has been publicly disclosed and may be actively used by attackers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10829
Vulnerability details
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of…
more
the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The command injection vulnerability in the HTTP POST Request Handler of the router's API endpoint directly enables exploitation of a public-facing application (T1190) to achieve arbitrary command execution on the Unix-based device (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching of the vulnerable H3C router firmware to eliminate the command injection flaw in the HTTP POST handler.
Prevents command injection by enforcing input validation and error handling on POST requests to the /api/wizard/getWifiNeighbour endpoint.
Limits exploitation by controlling network traffic at boundaries to block unauthorized local network access to the vulnerable API endpoint.