GCVE - cpe:2.3:a:h3c:magic_nx400:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:h3c:magic_nx400:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	H3C (`17378f50-e353-55bc-ad2a-c62425dcc44c`)
Product	Magic Nx400 (`351bc668-915d-5df1-87dc-64945a1480e0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-3546`	vulnerable	2026-06-08 07:23:09.321323	H3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injection HIGH (8) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Published: 2025-04-14T01:31:07.222Z Updated: 2025-04-14T15:54:23.768Z Open on db.gcve.eu Reference links https://vuldb.com/?id.304585 https://vuldb.com/?ctiid.304585 https://vuldb.com/?submit.524745 https://gist.github.com/isstabber/154661f329e4ae6bfe15dcdc0b932ff3 https://zhiliao.h3c.com/theme/details/229784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3545`	vulnerable	2026-06-08 07:23:09.320468	H3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injection HIGH (8) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/setLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Published: 2025-04-14T01:00:09.263Z Updated: 2025-04-14T15:55:20.861Z Open on db.gcve.eu Reference links https://vuldb.com/?id.304584 https://vuldb.com/?ctiid.304584 https://vuldb.com/?submit.524744 https://gist.github.com/isstabber/cc7bc3281c0f0d6659d2f9934e1c57c1 https://zhiliao.h3c.com/theme/details/229784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3544`	vulnerable	2026-06-08 07:23:09.319781	H3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injection HIGH (8) A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getCapabilityWeb of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Published: 2025-04-14T00:31:07.721Z Updated: 2025-04-14T15:56:21.217Z Open on db.gcve.eu Reference links https://vuldb.com/?id.304583 https://vuldb.com/?ctiid.304583 https://vuldb.com/?submit.524743 https://gist.github.com/isstabber/05dfeefa3685a369b8802626e0252e27 https://zhiliao.h3c.com/theme/details/229784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3543`	vulnerable	2026-06-08 07:23:09.319212	H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injection HIGH (8) A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGI_WizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Published: 2025-04-14T00:00:12.283Z Updated: 2025-04-14T17:14:07.365Z Open on db.gcve.eu Reference links https://vuldb.com/?id.304582 https://vuldb.com/?ctiid.304582 https://vuldb.com/?submit.524739 https://gist.github.com/mono7s/9369a3ef060b5655303cd234ba583bb5 https://zhiliao.h3c.com/theme/details/229784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3542`	vulnerable	2026-06-08 07:23:09.318346	H3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injection HIGH (8) A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Published: 2025-04-13T23:31:06.617Z Updated: 2025-04-14T18:04:09.011Z Open on db.gcve.eu Reference links https://vuldb.com/?id.304581 https://vuldb.com/?ctiid.304581 https://vuldb.com/?submit.524738 https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5d https://zhiliao.h3c.com/theme/details/229784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3541`	vulnerable	2026-06-08 07:23:09.317931	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3540`	vulnerable	2026-06-08 07:23:09.317233	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3539`	vulnerable	2026-06-08 07:23:09.314735	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2732`	vulnerable	2026-06-08 07:16:58.145508	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2731`	vulnerable	2026-06-08 07:16:58.144782	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2730`	vulnerable	2026-06-08 07:16:58.144025	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2729`	vulnerable	2026-06-08 07:16:58.143136	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2728`	vulnerable	2026-06-08 07:16:58.142558	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2726`	vulnerable	2026-06-08 07:16:58.141433	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2725`	vulnerable	2026-06-08 07:16:58.138779	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.