What is CVE-2025-2728?

CVE-2025-2728 is a high-severity vulnerability in H3c Magic Nx30 Pro, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.0/10. Published 2025-03-25.

How severe is CVE-2025-2728?

High severity. CVSS v3 base score is 8.0 out of 10.

RCE in H3c Magic Nx30 Pro

CVE-2025-2728

A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component.

EPSS: 0.011 (61.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

H3c Magic Nx30 Pro — versions V100R014
H3c Magic Nx400 — versions V100R014

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (broken-link)
cna@vuldb.com (related)
cna@vuldb.com (patch)

Frequently asked questions

What is CVE-2025-2728?: CVE-2025-2728 is a high-severity vulnerability in H3c Magic Nx30 Pro, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.0/10. Published 2025-03-25.
How severe is CVE-2025-2728?: High severity. CVSS v3 base score is 8.0 out of 10.