EUVD-2026-44837
GHSA-5v3j-c5fm-2mm6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebUI endpoint requires no authentication (PR:N), no complexity; low-level CIA impact consistent with SQL injection on an appliance management database.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
AnalysisAI
SQL injection in H3C SecPath F1000-C8300 (firmware up to 20260522) allows unauthenticated remote attackers to manipulate database queries via the subject parameter in the /webui/?g=log_fw_nbc_mail_jsondata web management endpoint. The vendor has confirmed the vulnerability and acknowledged a planned fix, but no patch is released as of the disclosure date. A publicly available exploit exists (hosted on Feishu), lowering the bar for exploitation significantly despite the moderate CVSS 4.0 score of 5.5.
Technical ContextAI
The affected component is the web-based management interface (WebUI) of the H3C SecPath F1000-C8300 network security appliance, identified by CPE cpe:2.3:a:h3c:secpath_f1000-c8300:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class flaw. The vulnerable endpoint /webui/?g=log_fw_nbc_mail_jsondata handles firewall notification/mail-related log data, and the subject argument is passed unsanitized into a backend SQL query. H3C SecPath is a Chinese-branded firewall/UTM appliance line; the F1000-C8300 is positioned as an enterprise-grade security gateway. The WebUI is typically exposed on the management plane interface.
RemediationAI
No vendor-released patch has been identified at time of analysis; H3C has confirmed the vulnerability and stated that a technical fix is planned for future release. Monitor https://vuldb.com/vuln/379367 and the H3C security advisory channels for patch availability. As an immediate compensating control, restrict access to the WebUI management interface to trusted management networks only using ACLs or firewall rules - this is the most effective mitigation since the attack vector requires network reachability to the WebUI. If the management interface must remain accessible, consider deploying an intermediate reverse proxy or WAF capable of inspecting and blocking SQL metacharacters in HTTP parameters as a secondary control (note: WAF coverage is imperfect and should not substitute for patching). Avoid exposing the management plane interface to untrusted or internet-facing networks under any circumstances.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today