CVE-2025-2725

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

• CWE-74
• CWE-77

• https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md
• https://vuldb.com/?ctiid.300745
• https://vuldb.com/?id.300745
• https://vuldb.com/?submit.520390
• https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
• https://zhiliao.h3c.com/theme/details/229784
• https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md

Published

Mar 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27244AssetView and AssetView CLOUD contain an issue with acquirin…5.9
• CVE-2025-27245Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-27246Incorrect default permissions for the Intel(R) Processor Ide…6.7
• CVE-2025-27247in OpenHarmony v5.0.3 and prior versions allow a local attac…5.5
• CVE-2025-27248in OpenHarmony v5.0.3 and prior versions allow a local attac…5.5
• CVE-2025-27249Uncontrolled resource consumption for some Gaudi software be…6.8
• CVE-2025-27250Uncontrolled resource consumption for some Edge Orchestrator…5.1
• CVE-2025-27251Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-27253A CWE-15 "External Control of System or Configuration Settin…6.1
• CVE-2025-27254CWE-282 "Improper Ownership Management" in GE Vernova EnerVi…8
• CVE-2025-27255Use of Hard-coded Credentials vulnerability in GE Vernova En…8
• CVE-2025-27256Missing Authentication for Critical Function vulnerability i…8.3