H3C Magic BE18000 up to V200R007 esps.dhcpd.vlan /api/esps command injection

Summaryinfo

A vulnerability marked as very critical has been reported in H3C Magic BE18000, Magic NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510 and NE36 Pro up to V200R007. This affects an unknown part of the file /api/esps of the component esps.dhcpd.vlan/esps.filter.url/esps.apcm.version/esps.swcm.version/esps.system.ntp. Performing a manipulation results in command injection. This vulnerability was named CVE-2025-29296. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as very critical has been found in H3C Magic BE18000, Magic NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510 and NE36 Pro up to V200R007. This affects an unknown code of the file /api/esps of the component esps.dhcpd.vlan/esps.filter.url/esps.apcm.version/esps.swcm.version/esps.system.ntp. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.

This vulnerability is uniquely identified as CVE-2025-29296 since 03/11/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/04/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• H3C

Name

• Magic BE18000
• Magic NX15
• Magic NX30 Pro
• Magic NX400
• Magic R1510
• Magic R3010
• NE36 Pro

Version

• V100R0011
• V100R002
• V100R009
• V100R015
• V100R016
• V100R017
• V200R007

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion