CVE-2025-57295
Published: 18 September 2025
Summary
CVE-2025-57295 is a high-severity Weak Password Requirements (CWE-521) vulnerability in H3C Magic Nx15 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30199
Vulnerability details
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file.…
more
Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure default credentials (root with no password, H3C/admin) enable adversaries to use default accounts for unauthorized root-level access via network services.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
Vulnerability scans assess password policies and weak credential requirements against benchmarks.
User documentation on maintaining security includes password requirements, directly mitigating weak password policies.
Requires documented secure initialization practices and avoidance of insecure defaults in configuration baselines.
Reviewing and updating baseline when components are installed or upgraded prevents initialization with insecure defaults.
Configuration settings can define and enforce strong password requirements to avoid weak policies.
Requiring explicit configuration to minimal functionality overrides insecure defaults that would otherwise enable excess capabilities.
IA policy establishes password requirements, directly addressing weak password requirements.