CVE-2025-3546
Published: 14 April 2025
Summary
CVE-2025-3546 is a high-severity Injection (CWE-74) vulnerability in H3C Magic Nx15 Firmware. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 34.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-3546 is a command injection vulnerability affecting the HTTP POST Request Handler in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 firmware up to version V100R014. Specifically, the flaw resides in the FCGI_CheckStringIfContainsSemicolon function within the /api/wizard/getLanguage endpoint, where improper input handling permits injection of arbitrary commands via crafted POST requests.
An attacker with local network access and valid low-privileged credentials can exploit the issue to execute commands on the device, achieving full control over confidentiality, integrity, and availability of the affected router. The attack vector is limited to adjacent network adjacency with no user interaction required, and a public exploit has already been disclosed.
Vendor guidance recommends upgrading the affected devices to a patched firmware release; the H3C software download portal provides the current images and release notes for the listed Magic series models.
EPSS scores for this CVE rose from a low baseline to a recorded peak of 0.0107, indicating emerging exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10858
Vulnerability details
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of…
more
the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.