CVE-2025-29296

Summary

This vulnerability allows a remote attacker to execute arbitrary commands as root by exploiting multiple command injection flaws in the /api/esps request handler, leading to complete control of the affected device.

Exploitability

Exploitation is relatively straightforward given that attacker-controlled parameters are directly incorporated into shell expressions without validation, requiring only crafting a malicious request.

Blast radius

If exploited, the attacker can gain complete control over the device, potentially leading to data exfiltration, denial of service, or further network compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the specific version mentioned: H3C Magic BE18000 V200R007 or later, H3C NX400 V100R015 or later, and so on, as detailed in the description.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.