CVE-2025-61330: Use of Hard-coded Password
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Immediate mitigation steps include disabling the Telnet service on all affected devices to prevent remote unauthenticated access. Network administrators should audit device configurations to ensure Telnet is not enabled or accessible from untrusted networks. Changing any default or weak passwords on the root account is critical, although the hard-coded nature may limit this option until firmware updates are available. Network segmentation and firewall rules should be implemented to restrict access to device management interfaces, especially those exposed via Virtual Server configurations. Monitoring network traffic for unusual Telnet connections or root-level access attempts can help detect exploitation attempts. Organizations should engage with H3C or authorized vendors to obtain firmware updates or patches addressing this vulnerability as soon as they are released. Where possible, consider replacing affected devices with alternatives that do not have this vulnerability. Finally, incident response plans should be updated to handle potential exploitation scenarios involving these devices.
Description
A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. The vulnerability stems from the use of a hard-coded weak password for the root account in the /etc/shadow configuration or even the absence of any password at all. Some of these devices have the Telnet service enabled by default, or users can choose to enable the Telnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices have related interfaces called Virtual Servers, which can map the devices to the public network, posing the risk of remote attacks. Therefore, attackers can obtain the highest root privileges of the devices through the Telnet service using the weak password hardcoded in the firmware (or without a password), and remote attacks are possible.