CVE-2025-2731

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

• CWE-74
• CWE-77

• https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md
• https://vuldb.com/?ctiid.300751
• https://vuldb.com/?id.300751
• https://vuldb.com/?submit.520497
• https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
• https://zhiliao.h3c.com/theme/details/229784
• https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md

Published

Mar 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27304Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-27305Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-27306Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-27307Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-27308Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-27309Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-27310Missing Authorization vulnerability in Radius of Thought Pag…6.5
• CVE-2025-27311Cross-Site Request Forgery (CSRF) vulnerability in luk3thoma…4.3
• CVE-2025-27312Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2025-27313Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-27314Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-27315Cross-Site Request Forgery (CSRF) vulnerability in wptom All…4.3