CVE-2025-29296: n/a
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.
AI Analysis
Technical Summary
CVE-2025-29296 describes multiple command injection vulnerabilities in H3C devices including Magic BE18000 V200R007, NX400 V100R015, Magic NX30 Pro V100R0011, Magic R3010 V100R009, Magic NX15 V100R017, Magic R1510 V100R016, NE36 Pro V100R002, and MC102G HM1A0V200R010. The vulnerabilities reside in the /api/esps request handler affecting object interfaces such as esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete on NX15 only), esps.swcm.version (delete, upgrade on all except NX15), and esps.system.ntp (set on all except NX15). Attacker-controlled input is incorporated into shell expressions executed by eval without adequate validation, enabling remote command execution as root and complete device control.
Potential Impact
An attacker can remotely execute arbitrary commands with root privileges on affected devices, resulting in complete compromise of the device. This can lead to unauthorized control, data theft, disruption of network services, and potential pivoting within the network environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices' management interfaces and monitor for suspicious activity related to the /api/esps endpoint.
CVE-2025-29296: n/a
Description
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-29296 describes multiple command injection vulnerabilities in H3C devices including Magic BE18000 V200R007, NX400 V100R015, Magic NX30 Pro V100R0011, Magic R3010 V100R009, Magic NX15 V100R017, Magic R1510 V100R016, NE36 Pro V100R002, and MC102G HM1A0V200R010. The vulnerabilities reside in the /api/esps request handler affecting object interfaces such as esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete on NX15 only), esps.swcm.version (delete, upgrade on all except NX15), and esps.system.ntp (set on all except NX15). Attacker-controlled input is incorporated into shell expressions executed by eval without adequate validation, enabling remote command execution as root and complete device control.
Potential Impact
An attacker can remotely execute arbitrary commands with root privileges on affected devices, resulting in complete compromise of the device. This can lead to unauthorized control, data theft, disruption of network services, and potential pivoting within the network environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices' management interfaces and monitor for suspicious activity related to the /api/esps endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-03-11T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6a721d52bf8831d53928c5d1
Added to database: 08/04/2026, 17:11:46 UTC
Last enriched: 08/11/2026, 17:56:31 UTC
Last updated: 09/17/2026, 22:01:29 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.