CVE-2025-3541

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this issue is the function FCGI_WizardProtoProcess of the file /api/wizard/getSpecs of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Apr 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-35428.0A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the CVE-2025-35438.0A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. Thi CVE-2025-354306.5CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenti CVE-2025-354315.4CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization da CVE-2025-354327.5CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited CVE-2025-354338.8CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used toke CVE-2025-354349.8CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium clust CVE-2025-354354.3CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to cra CVE-2025-354367.5CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could caus CVE-2025-35448.0A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as cri CVE-2025-35458.0A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classifi CVE-2025-354519.8PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readi