H3C Intelligent Management Center (iMC) versions up to E0632H07 contain a remote command execution vulnerability due to improper deserialization of untrusted data (CWE-502) in the JSF ViewState parameter at the /byod/index.xhtml endpoint. Attackers can exploit this by sending forged POST requests with manipulated javax.faces.ViewState values without needing authentication or session cookies. This vulnerability allows arbitrary command execution on the affected system. The affected version range is not fully defined beyond 'up to E0632H07'. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity. No known exploits in the wild have been reported, and no patches or vendor advisories are currently available.

Successful exploitation results in unauthenticated remote command execution on vulnerable H3C iMC systems, potentially allowing full system compromise. The vulnerability affects versions up to E0632H07 and does not require any user interaction or credentials. This represents a critical security risk for affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the /byod/index.xhtml endpoint and monitor for suspicious POST requests with unusual javax.faces.ViewState parameters. Consider network-level controls to limit exposure of the iMC management interface to trusted administrators only.