CVE-2025-29296 in Magic BE18000
Summary
by MITRE • 08/04/2026
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability represents a critical command injection flaw affecting multiple H3C network devices including the Magic BE18000 V200R007, NX400 V100R015, NX30 Pro V100R0011, R3010 V100R009, NX15 V100R017, R1510 V100R016, and NE36 Pro V100R002 models. The vulnerability exists within the /api/esps request handler where attacker-controlled parameters are directly incorporated into shell expressions executed through eval() function without proper input validation or sanitization mechanisms. This design flaw creates a direct path for remote code execution attacks that can be exploited by malicious actors to gain complete administrative control over affected devices.
The technical implementation of this vulnerability stems from improper handling of user-supplied data within the API endpoint's request processing logic. When legitimate users submit requests to the affected interfaces such as esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, and esps.system.ntp, the system fails to properly validate or sanitize the input parameters before incorporating them into shell commands. This pattern aligns with CWE-77 and CWE-94 classifications, specifically addressing command injection vulnerabilities where untrusted data is passed to system execution functions. The use of eval() for executing dynamic shell commands without proper parameter validation creates an environment where arbitrary code can be executed with the privileges of the root user, as evidenced by the vulnerability's ability to grant complete device control.
The operational impact of this vulnerability extends across multiple device models and affects critical network infrastructure components including DHCP services, URL filtering, access point management, software version control, and NTP configuration. Attackers exploiting these vulnerabilities can execute commands with root privileges, potentially leading to complete system compromise, data exfiltration, network disruption, or use of the compromised devices as launch points for further attacks within the network perimeter. The scope of affected interfaces suggests this vulnerability could be leveraged to manipulate network configurations, install malicious software, or establish persistent access to critical infrastructure components.
Security professionals should consider this vulnerability in relation to ATT&CK framework techniques such as T1059.001 (Command and Scripting Interpreter: PowerShell) and T1068 (Exploitation for Privilege Escalation) which describe how attackers can leverage command injection vulnerabilities to execute arbitrary code with elevated privileges. The vulnerability also maps to multiple MITRE ATT&CK tactics including Execution, Privilege Escalation, and Persistence. Organizations should implement immediate mitigations including network segmentation to limit access to affected API endpoints, applying firmware updates from H3C when available, implementing web application firewalls to filter suspicious requests, and conducting thorough network monitoring for unusual command execution patterns that may indicate exploitation attempts.
The affected device models represent a broad range of enterprise networking equipment that typically operate with elevated privileges and have direct access to critical network infrastructure. This vulnerability's presence across multiple generations of devices suggests either a systemic design flaw or inadequate security testing during development phases, potentially exposing organizations to coordinated attacks targeting their network infrastructure. The fact that the vulnerability affects both management interfaces and configuration services indicates that attackers could compromise not just the device's operational capabilities but also its ability to maintain secure communications with other network components, potentially leading to widespread service disruption or unauthorized network access.
Organizations should prioritize immediate assessment of their network exposure by identifying all affected devices within their infrastructure, implementing temporary network controls to restrict access to the vulnerable API endpoints, and preparing incident response procedures in case of exploitation. The vulnerability's remote exploitability without authentication requirements makes it particularly dangerous as attackers could compromise devices from outside the organization's network perimeter, potentially leading to significant operational disruption or data breaches. Security teams should also consider deploying network monitoring solutions capable of detecting unusual command execution patterns that may indicate successful exploitation attempts and establish communication channels with H3C for firmware updates addressing this critical vulnerability.