EUVD-2025-210615
GHSA-v3vj-88w4-57r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated request to /api/esps injects commands via eval with no user interaction, yielding root code execution and full confidentiality, integrity, and availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.
AnalysisAI
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Technical ContextAI
The affected devices are consumer/SOHO H3C 'Magic' Wi-Fi routers and gateway appliances running the ESPS backend, which exposes a JSON-style RPC surface at /api/esps addressing named object interfaces and methods. The flaw is a classic CWE-77 command injection: parameters from the HTTP request are concatenated into shell command strings that are then executed through eval, so shell metacharacters and command substitution in request fields are interpreted by the underlying shell. Multiple methods are impacted - esps.dhcpd.vlan (getlist/delete), esps.filter.url (add/modify), esps.apcm.version (delete, NX15 only), esps.swcm.version (delete/upgrade, all models except NX15), and esps.system.ntp (set, all models except NX15) - indicating a systemic pattern of building shell commands from user input rather than a single isolated bug. The generic CPE (cpe:2.3:a:n/a:n/a) provides no machine-readable product/version granularity, so the affected-product mapping must be taken from the human-readable description.
RemediationAI
No vendor-released patch version is identified in the available data, so upgrade guidance cannot cite a fixed firmware build - monitor the H3C security portal (https://www.h3c.com) for firmware updates covering the listed models and revisions and apply them once published. As compensating controls, ensure the router management/HTTP API (the /api/esps handler) is not reachable from the WAN/internet - disable remote/cloud management and block inbound access to the web management port at the perimeter, accepting the trade-off of losing off-LAN administration. Restrict management-interface access to a trusted management VLAN or specific admin hosts on the LAN, and where feasible place these devices behind an upstream firewall that filters requests to /api/esps. Because exploitation requires no authentication, changing admin credentials does not mitigate the flaw; network-level access restriction is the only effective interim control. Technical details are documented at the referenced advisory: https://app.notion.com/p/Multiple-Command-Injection-Vulnerabilities-in-Several-H3C-Network-Devices-3b2797159f158056bfd1c3ba38e7a7b7.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today