---METADATA---
VENDOR: H3C
PRODUCT: Magic B0
AFFECTED_VERSIONS: Up to 100R002
---END_METADATA---

Description Summary:
A vulnerability has been identified in the H3C Magic B0 router series affecting software versions up to 100R002.

Executive Summary:
The H3C Magic B0 router is subject to a high-severity vulnerability that could allow for unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2026-9393

Affected Software: H3C Magic B0

Affected Versions: Up to 100R002

Vulnerability: This vulnerability affects H3C Magic B0 routers, potentially exposing the device to external exploitation. While specific technical details are pending, the high CVSS score suggests a critical flaw that could allow an attacker to gain unauthorized access or control over the device.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the availability and security of the network infrastructure. Unauthorized control of an H3C Magic B0 router could facilitate man-in-the-middle attacks, traffic redirection, and the potential compromise of sensitive corporate data.

Remediation Plan

Immediate Action: Upgrade H3C Magic B0 firmware to the latest version beyond 100R002 immediately to remediate the vulnerability.

Proactive Monitoring: Continuously monitor device performance and review security logs for any unusual behavior or unauthorized administrative activity.

Compensating Controls: Use strict network ingress filtering to limit access to the router's management interface from unauthorized or external IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All administrators managing H3C Magic B0 devices should verify their current firmware version and expedite the patching process. Addressing this vulnerability is critical to maintaining a secure network perimeter.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the H3C Magic B3 networking hardware. Further technical details remain under investigation by the manufacturer.

Executive Summary:
A critical security vulnerability in H3C Magic B3 networking hardware poses a significant risk to network integrity, requiring immediate attention from infrastructure teams.

Vulnerability Details

CVE-ID: CVE-2026-8764

Affected Software: H3C Magic B3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the H3C Magic B3 series. As this involves networking hardware, the flaw may facilitate unauthorized network access or remote command execution, depending on the specific nature of the vulnerability.

Business Impact

With a CVSS score of 7.2, this vulnerability represents a high risk to the organization's network perimeter and internal security. Successful exploitation could allow attackers to bypass security controls, leading to potential network-wide compromise.

Remediation Plan

Immediate Action: Check the H3C support portal for firmware updates for the Magic B3 series and apply them immediately to all affected devices.

Proactive Monitoring: Inspect network traffic logs for unusual management plane activity, such as unauthorized SSH or web-based administrative access attempts.

Compensating Controls: Isolate management interfaces from the public internet and restrict administrative access to a dedicated, secure management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network administrators should treat this as a high-priority update. Given the nature of the affected hardware, failing to apply firmware patches could leave the entire network infrastructure vulnerable to unauthorized access.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B1
AFFECTED_VERSIONS: Up to 100R004
---END_METADATA---

Description Summary:
A security vulnerability exists in H3C Magic B1 routers up to version 100R004.

Executive Summary:
A high-severity security vulnerability in H3C Magic B1 routers requires immediate attention to prevent potential unauthorized access and compromise.

Vulnerability Details

CVE-ID: CVE-2026-6581

Affected Software: H3C Magic B1

Affected Versions: Up to 100R004

Vulnerability: This vulnerability affects the H3C Magic B1 series. The flaw allows for potential security compromise, necessitating a review of the vendor’s security advisory for specific attack vectors and remediation steps.

Business Impact

Exploitation of this vulnerability could lead to unauthorized administrative control of network hardware, potentially resulting in data interception or network disruption. With a CVSS score of 8.8, this is a significant risk that could impact the security posture of the entire network.

Remediation Plan

Immediate Action: Update H3C Magic B1 firmware to the latest recommended version provided by the manufacturer.

Proactive Monitoring: Monitor router logs for unauthorized configuration changes or anomalous traffic patterns originating from the device.

Compensating Controls: Restrict administrative access to the router to trusted internal management subnets only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of H3C Magic B1 routers should verify their firmware version and apply the latest security updates immediately. Given the high CVSS score, organizations should treat this as a priority update to prevent potential network exploitation.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B1
AFFECTED_VERSIONS: Up to 100R004
---END_METADATA---

Description Summary:
A security vulnerability exists in H3C Magic B1 routers up to version 100R004.

Executive Summary:
A high-severity security vulnerability in H3C Magic B1 routers requires immediate attention to prevent potential unauthorized access and compromise.

Vulnerability Details

CVE-ID: CVE-2026-6563

Affected Software: H3C Magic B1

Affected Versions: Up to 100R004

Vulnerability: This vulnerability affects the H3C Magic B1 series. The flaw allows for potential security compromise, necessitating a review of the vendor’s security advisory for specific attack vectors and remediation steps.

Business Impact

Exploitation of this vulnerability could lead to unauthorized administrative control of network hardware, potentially resulting in data interception or network disruption. With a CVSS score of 8.8, this is a significant risk that could impact the security posture of the entire network.

Remediation Plan

Immediate Action: Update H3C Magic B1 firmware to the latest recommended version provided by the manufacturer.

Proactive Monitoring: Monitor router logs for unauthorized configuration changes or anomalous traffic patterns originating from the device.

Compensating Controls: Restrict administrative access to the router to trusted internal management subnets only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of H3C Magic B1 routers should verify their firmware version and apply the latest security updates immediately. Given the high CVSS score, organizations should treat this as a priority update to prevent potential network exploitation.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B0
AFFECTED_VERSIONS: Up to 100R002
---END_METADATA---

Description Summary:
A security vulnerability exists in H3C Magic B0 routers up to version 100R002.

Executive Summary:
A high-severity security vulnerability in H3C Magic B0 routers requires immediate attention to prevent potential unauthorized access and compromise.

Vulnerability Details

CVE-ID: CVE-2026-6560

Affected Software: H3C Magic B0

Affected Versions: Up to 100R002

Vulnerability: While specific technical details are limited, this vulnerability affects the H3C Magic B0 series. The flaw allows for potential security compromise, necessitating a review of the vendor’s security advisory for specific attack vectors.

Business Impact

Exploitation of this vulnerability could lead to unauthorized administrative control of network hardware, potentially resulting in data interception or network disruption. With a CVSS score of 8.8, this is a significant risk that could impact the security posture of the entire network.

Remediation Plan

Immediate Action: Update H3C Magic B0 firmware to the latest recommended version provided by the manufacturer.

Proactive Monitoring: Monitor router logs for unauthorized configuration changes or anomalous traffic patterns originating from the device.

Compensating Controls: Restrict administrative access to the router to trusted internal management subnets only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of H3C Magic B0 routers should verify their firmware version and apply the latest security updates immediately. Given the high CVSS score, organizations should treat this as a priority update to prevent potential network exploitation.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B1 Router
AFFECTED_VERSIONS: Up to 100R004
---END_METADATA---

Description Summary:
A security vulnerability in the H3C Magic B1 router up to version 100R004 could allow for unauthorized device access or control.

Executive Summary:
H3C Magic B1 routers are affected by a high-severity vulnerability that could allow attackers to compromise the device and the network it serves.

Vulnerability Details

CVE-ID: CVE-2026-3701

Affected Software: H3C Magic B1

Affected Versions: Up to 100R004

Vulnerability: While the specific vulnerability type is not detailed, it affects the Magic B1 router firmware. The CVSS score of 8.8 suggests a significant flaw, likely involving remote access or administrative bypass.

Business Impact

A compromise of a perimeter router like the Magic B1 allows attackers to monitor network traffic, perform man-in-the-middle attacks, or launch further attacks against internal network assets. The CVSS score of 8.8 reflects the high severity of a router-level compromise.

Remediation Plan

Immediate Action: Update the H3C Magic B1 firmware to a version newer than 100R004 immediately.

Proactive Monitoring: Monitor for unusual administrative logins to the router and check for unauthorized changes to DNS or routing settings.

Compensating Controls: Disable remote management features on the WAN interface and restrict local management access to specific trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. Router vulnerabilities are frequently targeted by state-sponsored actors and botnets once technical details are known.

Analyst Recommendation

Immediate firmware updates are critical for all affected H3C Magic B1 routers. Network administrators should treat this as a high-priority task to ensure the security of the network perimeter.

---METADATA---
VENDOR: H3C
PRODUCT: NX15
AFFECTED_VERSIONS: H3C NX15: V100R017
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A weak password recovery vulnerability in H3C NX15 V100R017 allows unauthenticated attackers to manipulate account security settings.

Executive Summary:
A vulnerability in H3C NX15 firmware allows unauthenticated attackers to exploit weak password recovery mechanisms, potentially leading to unauthorized account access.

Vulnerability Details

CVE-ID: CVE-2026-15479

Affected Software: H3C NX15

Affected Versions: H3C NX15: V100R017

Vulnerability: The flaw is identified as CWE-640 (Weak Password Recovery), which allows an unauthenticated, network-adjacent attacker to perform unauthorized password recovery actions.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of administrative or user accounts on the affected networking device. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality, potentially allowing attackers to pivot deeper into the corporate environment.

Remediation Plan

Immediate Action: Contact H3C support to obtain the latest firmware patch; if no patch is available, restrict management interface access to trusted administrative subnets only.

Proactive Monitoring: Review device access logs for unusual password reset requests or unauthorized administrative login attempts originating from unknown IP addresses.

Compensating Controls: Implement strict firewall rules to ensure the management interface of the NX15 device is not exposed to the public internet or untrusted network segments.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept repository exists on GitHub (coconut652-7/IOT_Vul_Public).

Analyst Notes: As of July 12, 2026, there is no confirmed active exploitation in the wild; however, the presence of a public proof-of-concept makes this a credible threat that requires immediate attention. The flaw’s pre-authentication nature makes it highly attractive for automated exploitation attempts against exposed devices.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators should prioritize restricting network access to the affected hardware and coordinate with the vendor to verify if a firmware update is available to resolve the underlying authentication weakness.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B0
AFFECTED_VERSIONS: H3C Magic B0 up to 100R002
---END_METADATA---

Description Summary:
A security vulnerability has been detected in the H3C Magic B0 router series.

Executive Summary:
The H3C Magic B0 router is impacted by a high-severity vulnerability that could jeopardize network security.

Vulnerability Details

CVE-ID: CVE-2026-10259

Affected Software: H3C Magic B0

Affected Versions: Up to 100R002

Vulnerability: This vulnerability affects the H3C Magic B0 series, potentially allowing an attacker to exploit flaws within the device firmware to gain unauthorized access or influence device behavior.

Business Impact

The CVSS score of 8.8 indicates a high risk to the network. An attacker successfully exploiting this vulnerability could gain control over the network gateway, enabling traffic interception, man-in-the-middle attacks, or complete exclusion from network resources.

Remediation Plan

Immediate Action: Monitor the H3C support portal for firmware updates and apply them as soon as they become available.

Proactive Monitoring: Review network logs for unusual administrative logins or anomalous traffic originating from the H3C device.

Compensating Controls: Isolate the management interface of the router from the public internet and restrict access to a dedicated management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Owners of H3C Magic B0 devices should monitor for firmware updates diligently. Until a patch is available, ensure that administrative access to the device is strictly controlled and limited to authorized users.

---METADATA---
VENDOR: H3C
PRODUCT: GR-3000AX
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the H3C GR-3000AX router that may pose a risk to network security.

Executive Summary:
A high-severity vulnerability in the H3C GR-3000AX router could potentially allow an attacker to compromise network infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-6091

Affected Software: H3C GR-3000AX

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the firmware of the H3C GR-3000AX model. Given the classification, it is likely that this flaw allows an unauthenticated attacker to perform unauthorized actions, potentially leading to a complete compromise of the network device.

Business Impact

The CVSS score of 8.8 indicates a high level of risk for this network appliance. Successful exploitation could compromise all traffic passing through the router, leading to potential data exfiltration, man-in-the-middle attacks, and significant disruption to business operations.

Remediation Plan

Immediate Action: Upgrade the firmware of all affected H3C GR-3000AX units to the latest version released by the vendor.

Proactive Monitoring: Monitor logs for unauthorized login attempts or unexpected changes to the device configuration.

Compensating Controls: Isolate the management plane of the router from the public internet and use VPNs for any necessary remote administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability targets critical network hardware, it is imperative to apply patches immediately. Failure to address this could lead to widespread network compromise and loss of data confidentiality.

---METADATA---
VENDOR: H3C
PRODUCT: GR-5400AX
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A critical vulnerability has been identified in the H3C GR-5400AX router, potentially allowing unauthorized access or control.

Executive Summary:
A critical, high-severity vulnerability in the H3C GR-5400AX router could permit unauthorized access, threatening network integrity.

Vulnerability Details

CVE-ID: CVE-2025-6090

Affected Software: H3C GR-5400AX

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a critical security vulnerability identified in the firmware of the H3C GR-5400AX device. While specific technical details are limited, such flaws often involve authentication bypass or command injection vulnerabilities that allow an unauthenticated attacker to gain administrative control.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to edge network security. Exploitation could allow an attacker to intercept traffic, redirect connections, or gain a foothold within the internal corporate network, leading to potential data breaches and unauthorized lateral movement.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by H3C immediately to patch the affected device.

Proactive Monitoring: Inspect network traffic logs for unauthorized administrative access attempts or irregular outbound connections originating from the router.

Compensating Controls: Ensure the router management interface is not exposed to the public internet and restrict access to trusted internal IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network infrastructure vulnerabilities are critical as they provide broad access. Organizations utilizing the H3C GR-5400AX should prioritize firmware updates and verify that management interfaces are properly secured from external access.

Executive Summary:
A critical misconfiguration vulnerability has been identified in specific H3C wireless controllers and access points. This flaw allows an unauthenticated, remote attacker to upload files via anonymous FTP, which are then incorrectly owned by the root user, enabling the attacker to gain complete administrative control over the affected devices and the network segments they manage.

Vulnerability Details

CVE-ID: CVE-2025-60262

Affected Software: H3C M102G Wireless Controller, H3C BA1500L Wireless Access Point

Affected Versions:

• H3C M102G firmware version HM1A0V200R010
• H3C BA1500L firmware version SWBA1A0V100R006

Vulnerability:
The vulnerability exists due to a misconfiguration in the vsftpd (Very Secure FTP Daemon) service running on the affected devices. The service is configured to allow anonymous FTP access, and any files uploaded through this anonymous session are incorrectly assigned ownership to the 'root' user instead of a non-privileged user. An unauthenticated remote attacker with network access to the FTP port (TCP/21) can exploit this by uploading a malicious file, such as a script or a system configuration file (e.g., a cron job), to a predictable location. When the device's operating system executes this file, it does so with root privileges, leading to arbitrary code execution and a full system compromise.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation grants an attacker complete, root-level control over the affected network infrastructure devices. This can lead to severe consequences, including interception and manipulation of all network traffic passing through the device, unauthorized access to sensitive internal networks, deployment of ransomware or other malware, and complete disruption of wireless network services. The compromise of these core network devices poses a significant risk to data confidentiality, integrity, and availability for the entire organization.

Remediation Plan

Immediate Action:
Organizations must immediately apply the security patches provided by the vendor. Update the firmware of all affected H3C M102G and BA1500L devices to the latest recommended version to correct the vsftpd misconfiguration. After patching, it is crucial to monitor for any signs of post-patch exploitation attempts and review historical access logs for indicators of compromise.

Proactive Monitoring:

• Monitor network traffic for anomalous or unauthorized FTP connections (TCP port 21) to the affected devices, particularly from external IP addresses.
• Review FTP server logs for anonymous login events and file upload activities (STOR commands).
• Implement file integrity monitoring on the devices to detect unexpected changes to system files, binaries, or scheduled task directories (e.g., /etc/cron.d/).
• Monitor for unusual outbound connections originating from the network devices, which could indicate a successful compromise.

Compensating Controls:
If immediate patching is not feasible, implement the following controls to mitigate risk:

• Use a network firewall or Access Control Lists (ACLs) on an upstream device to block all access to the FTP service (TCP port 21) from untrusted networks, especially the internet.
• If anonymous FTP is not required for business operations, disable the service entirely on the devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes:
As of the publication date of Jan 6, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the simplicity of exploitation and the high impact, it is highly likely that proof-of-concept exploits will be developed and released by security researchers or threat actors in the near future. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the potential for a complete and unauthenticated remote takeover of core network devices, this vulnerability represents an immediate and severe threat. We strongly recommend that organizations prioritize the patching of all affected H3C devices without delay. While there is no current evidence of active exploitation, the low complexity of the attack means that this status could change rapidly. If patching cannot be performed immediately, the compensating controls of restricting network access to the FTP service must be implemented as an urgent priority.

Executive Summary:
A high-severity vulnerability has been identified in certain H3C Magic M Devices, which could allow a remote attacker to take full control of the system. The flaw stems from a default password that, if unchanged, can be used to execute arbitrary code, potentially leading to network compromise, data theft, or service disruption. Organizations are urged to apply vendor-supplied patches immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2025-57578

Affected Software: H3C Magic M Device

Affected Versions: M2V100R006. See vendor advisory for a complete list of affected products and versions.

Vulnerability: This vulnerability allows a remote, unauthenticated attacker to gain administrative access to the affected H3C device by using a default password. Once authenticated, the attacker can exploit further weaknesses in the device's software to execute arbitrary code with system-level privileges. The attack vector is the device's management interface, which is often exposed to the network.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8. Successful exploitation could lead to a complete compromise of the affected device. Potential consequences include the theft of sensitive data transiting the network, disruption of network services, and the ability for an attacker to use the compromised device as a pivot point to move laterally within the organization's internal network. This poses a significant risk of operational downtime, data breaches, and reputational damage.

Remediation Plan

Immediate Action:

• Immediately apply the security updates provided by H3C to all affected devices.
• If patching is not immediately possible, change the default administrator password to a strong, unique password.
• Review system and access logs for any unauthorized login attempts or suspicious activity originating from the device's management interface.

Proactive Monitoring:

• Implement continuous monitoring of authentication logs for the H3C device, specifically looking for repeated login failures or successful logins from untrusted IP addresses.
• Monitor network traffic for any unusual outbound connections from the device, which could indicate a compromise.
• Establish alerts for any unauthorized configuration changes or the execution of unexpected processes on the device.

Compensating Controls:

• If patching is delayed, restrict access to the device's management interface to a dedicated and trusted network segment or specific IP addresses.
• Implement network segmentation to isolate the H3C device from critical internal assets, limiting the potential impact of a compromise.
• Ensure all default credentials on all network devices are changed as a matter of security policy.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 12, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities related to default credentials are trivial to exploit and are frequently targeted by threat actors shortly after public disclosure.

Analyst Recommendation

Given the high severity (CVSS 8) and the ease of exploitation, this vulnerability presents a critical risk to the organization. We strongly recommend that the vendor-provided patch be applied to all affected H3C devices on an emergency basis. Although this CVE is not currently listed on the CISA KEV list, its characteristics make it a prime candidate for future inclusion. If patching cannot be performed immediately, implement the recommended compensating controls, especially changing the default password and restricting network access to the management interface, to reduce the attack surface.

Executive Summary:
A high-severity vulnerability has been identified in multiple H3C products, allowing a remote attacker to gain complete control of affected devices. The flaw stems from a default password which can be used to execute arbitrary code, posing a significant risk of network compromise, data theft, and service disruption. Organizations are urged to apply vendor patches immediately to mitigate this threat.

Vulnerability Details

CVE-ID: CVE-2025-57577

Affected Software: issue Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability allows a remote, unauthenticated attacker to gain administrative access by using a hardcoded or predictable default password. Upon successful authentication to the device's management interface, an attacker can leverage built-in functionalities to upload malicious files or execute arbitrary system commands. This results in a complete compromise of the device, granting the attacker full control with the highest privilege level.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8. Successful exploitation could lead to a complete compromise of the affected network device. The potential business impact includes the exfiltration of sensitive network configuration data, eavesdropping on network traffic, and using the compromised device as a pivot point to launch further attacks against the internal network. This could result in significant operational disruption, reputational damage, and financial loss.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor (H3C) immediately to all affected devices. Prioritize patching for internet-facing systems. After patching, it is critical to verify that all default passwords have been changed to strong, unique credentials as a best practice.

Proactive Monitoring: Monitor authentication logs for successful and failed login attempts from unknown or untrusted IP addresses, particularly those using default usernames (e.g., admin, root). Network traffic should be monitored for unusual outbound connections or data flows originating from the management interface of affected devices. SIEM alerts should be configured to detect unauthorized configuration changes.

Compensating Controls: If patching cannot be performed immediately, restrict access to the device's management interface to a secure, isolated management network. Use firewall rules or access control lists (ACLs) to block access from the internet and other untrusted network segments. Immediately change any default passwords on devices that cannot be patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 12, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities related to default credentials are trivial to exploit and are frequently targeted by automated scanning tools once discovered. The simplicity of this attack vector means that exploitation is highly likely in the near future.

Analyst Recommendation
Given the high severity (CVSS 8) and the trivial nature of exploitation, we recommend that organizations treat this vulnerability with the highest priority. All affected H3C devices should be identified and patched immediately, starting with those directly exposed to the internet. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion and widespread exploitation. Proactive patching and changing default credentials are the most effective measures to prevent compromise.

---METADATA---
VENDOR: H3C
PRODUCT: Network Devices (Magic BE18000, NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510, NE36 Pro)
AFFECTED_VERSIONS: H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Multiple H3C network devices contain command injection vulnerabilities in the /api/esps request handler, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical command injection vulnerability in various H3C network devices allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-29296

Affected Software: H3C Network Devices

Affected Versions: H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002

Vulnerability: This is a command injection flaw within the /api/esps request handler. The device fails to validate user-supplied parameters before passing them to system shell expressions, which enables an unauthenticated attacker to execute arbitrary commands as root.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation grants an attacker complete administrative control over the affected network device, potentially leading to unauthorized network access, data interception, and total system downtime.

Remediation Plan

Immediate Action: Review the H3C security advisory for available firmware updates and apply them to all affected devices immediately.

Proactive Monitoring: Monitor device logs for anomalous API requests directed at the /api/esps endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict network segmentation and restrict access to the management interfaces of these devices to trusted management subnets using a firewall.

Exploitation Status

Public Exploit Available: Yes — the vulnerability is confirmed to have public proof-of-concept material available.

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to its unauthenticated nature and the high-privilege execution environment.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of proof-of-concept code, administrators should prioritize patching these devices immediately. If an official patch is pending, restrict all external access to the management API to prevent remote exploitation.

Executive Summary:
A high-severity vulnerability has been identified in H3C Magic B1 router firmware, which could allow a remote attacker to take complete control of an affected device. Successful exploitation of this weakness could lead to network-wide compromise, data interception, and significant operational disruption. Organizations using the affected products are urged to apply vendor-supplied patches immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2025-14196

Affected Software: H3C Magic B1

Affected Versions: All firmware versions up to and including 100R004

Vulnerability: The vulnerability is a command injection weakness within the web-based management interface of the H3C Magic B1 router. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted HTTP request to the device. The input is not properly sanitized before being used in a system command, allowing the attacker to inject and execute arbitrary commands on the underlying operating system with root-level privileges, resulting in a full compromise of the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit would grant an attacker complete administrative control over the affected network device. This could lead to severe consequences, including the ability to monitor, redirect, or block all network traffic, leading to data breaches and man-in-the-middle attacks. An attacker could also use the compromised router as a pivot point to launch further attacks against the internal network, or incorporate the device into a botnet for use in larger-scale attacks like Distributed Denial-of-Service (DDoS). The potential business impact includes data loss, service outages, reputational damage, and non-compliance with regulatory requirements.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected H3C Magic B1 devices immediately. After patching, administrators should review device access logs for any unauthorized logins or configuration changes that may have occurred prior to the update. Monitor network traffic for any unusual outbound connections originating from the device.

Proactive Monitoring: Implement enhanced monitoring of network traffic to and from the router's management interface. Security teams should look for anomalous HTTP requests containing special characters or shell commands, unexpected outbound connections from the device to unknown IP addresses, and any unauthorized changes to the device's configuration or firewall rules. Centralized log collection should be used to retain and analyze router logs for signs of compromise.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls:

• Restrict access to the device's web management interface to a dedicated, trusted administrative network segment.
• Use a firewall to block all external (internet-based) access to the management interface.
• Ensure strong, unique administrative credentials are in use for the device.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 7, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the high CVSS score and the relative simplicity of command injection vulnerabilities, it is highly likely that threat actors will develop and deploy exploits in the near future. Organizations should assume that scanning for vulnerable devices will begin imminently.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this vulnerability and the potential for a complete and remote device takeover, we strongly recommend that organizations treat this as a critical priority. All affected H3C Magic B1 devices must be patched immediately. Although this CVE is not currently listed on the CISA KEV list, its high impact score makes it a prime candidate for future inclusion and a valuable target for attackers. If patching is delayed for any reason, the compensating controls listed above must be implemented without exception to reduce the attack surface.

Executive Summary:
This report details a high-severity user enumeration vulnerability in H3C SSL VPN products, identified as CVE-2022-50800. The flaw allows unauthenticated attackers to remotely confirm the existence of valid usernames, which can then be used in targeted attacks like password spraying to gain unauthorized access to the corporate network. Organizations are urged to apply vendor patches immediately to mitigate the risk of a potential network breach.

Vulnerability Details

CVE-ID: CVE-2022-50800

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the login functionality of H3C SSL VPN solutions. An unauthenticated remote attacker can exploit this flaw by sending specially crafted POST requests to the login interface, manipulating the 'txtUsrName' parameter. The system provides a distinguishable response based on whether the submitted username is valid or invalid, allowing the attacker to systematically test a list of potential usernames and build a definitive list of valid accounts on the system.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Successful exploitation provides attackers with the foundational information needed for more advanced attacks. By obtaining a list of valid usernames, attackers can conduct highly effective password spraying or brute-force campaigns, significantly increasing the likelihood of account compromise and unauthorized access to the internal network. This could lead to data breaches, ransomware deployment, or further lateral movement within the organization's infrastructure.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor (H3C) across all affected SSL VPN appliances without delay. After patching, review VPN access logs for any signs of enumeration attempts or unusual login patterns that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor VPN logs for a high volume of failed login attempts from a single source IP address targeting multiple usernames. Implement alerting for rapid, sequential POST requests to the VPN login page. Monitor for successful logins that immediately follow a burst of failed attempts from the same IP, as this could indicate a successful password-spraying attack.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Use a Web Application Firewall (WAF) to enforce strict rate-limiting on the VPN login page to slow down or block automated enumeration attempts.
• Enforce Multi-Factor Authentication (MFA) for all VPN users to ensure that a compromised password alone is not sufficient for access.
• Ensure a robust account lockout policy is in place to temporarily disable accounts after a set number of failed login attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 31, 2025, there are no known public exploits specifically targeting this CVE. However, user enumeration is a common and well-understood attack technique, and scripts to exploit this type of vulnerability are trivial for a skilled attacker to create.

Analyst Recommendation

Given the high CVSS score of 7.5 and the critical role this vulnerability plays as a precursor to account compromise, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. While this CVE is not currently on the CISA KEV list, its potential to facilitate unauthorized network access makes it a significant risk. Organizations should treat this as an urgent priority and implement compensating controls like MFA and rate-limiting to add layers of defense against this threat.