CVE-2025-29296: H3C Router Command Injection Vulnerability

CVE-2025-29296 Overview

CVE-2025-29296 is a set of command injection vulnerabilities affecting multiple H3C network devices, including the Magic BE18000, NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510, NE36 Pro, and MC102G. The flaws reside in the /api/esps request handler, where attacker-controlled parameters flow into shell expressions executed by eval without sufficient validation. A remote, unauthenticated attacker can execute arbitrary commands as root and take complete control of the affected device. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root over the network, resulting in full device compromise across a wide range of H3C consumer and enterprise networking products.

Affected Products

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C NE36 Pro V100R002
H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic R1510 V100R016
H3C Magic NX15 V100R017 and H3C MC102G HM1A0V200R010

Discovery Timeline

2026-08-04 - CVE-2025-29296 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2025-29296

Vulnerability Analysis

The vulnerability exists in the /api/esps request handler exposed by the affected H3C devices. Several object interfaces and methods pass request parameters directly into shell command strings that are subsequently executed through eval. Because the handler performs no adequate input validation or neutralization, shell metacharacters embedded in request parameters are interpreted by the shell.

The affected interfaces and methods include esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, on Magic NX15 only), esps.swcm.version (delete, upgrade, on all affected models except Magic NX15), and esps.system.ntp (set, on all affected models except Magic NX15). Each represents a distinct injection sink reachable through the same request handler.

Exploitation results in code execution as root, providing complete control over device configuration, network traffic, credentials, and downstream connected systems.

Root Cause

The root cause is unsafe construction of shell command strings from untrusted HTTP request parameters. The affected code uses eval to run these strings, treating attacker-controlled values as executable shell syntax rather than data. There is no allow-listing, escaping, or parameterized command execution applied before the shell interprets the input.

Attack Vector

An attacker sends a crafted HTTP request to /api/esps targeting one of the vulnerable object interface methods. The attacker injects shell metacharacters (such as backticks, $(), ;, or |) into a parameter that reaches the eval-executed command. The router-side shell then evaluates the injected payload with root privileges. No authentication or user interaction is required, and the flaw is reachable over the network.

See the Notion Vulnerability Report for method-level detail on each injection sink.

Detection Methods for CVE-2025-29296

Indicators of Compromise

HTTP requests to /api/esps containing shell metacharacters such as `, $(, ;, |, or && inside JSON parameter values targeting esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, or esps.system.ntp.
Unexpected outbound connections initiated by the router management plane, including reverse shells or downloads via wget, curl, or tftp shortly after /api/esps traffic.
New or modified system accounts, cron entries, or startup scripts on affected H3C devices.

Detection Strategies

Inspect HTTP request bodies destined for /api/esps on affected H3C devices and flag payloads containing shell metacharacters within the listed object interface methods.
Correlate /api/esps requests with subsequent process creation or outbound network activity from the device management interface.
Baseline normal administrative access to H3C management endpoints and alert on requests originating from unexpected source addresses or user agents.

Monitoring Recommendations

Forward router and firewall logs, along with network flow data, to a centralized analytics platform for correlation across /api/esps traffic and downstream device behavior.
Monitor for firmware or configuration changes on H3C devices outside of approved change windows.
Track DNS and outbound connections from network device management IP addresses for anomalies consistent with post-exploitation activity.

How to Mitigate CVE-2025-29296

Immediate Actions Required

Restrict access to the /api/esps management endpoint to trusted administrative networks only, using ACLs on upstream firewalls or the device itself.
Disable remote (WAN-side) management on affected H3C devices until vendor firmware updates are applied.
Rotate administrative credentials and audit device configurations for unauthorized changes on any device that may have been exposed to the internet.

Patch Information

At the time of publication, no specific fixed firmware versions are listed in the NVD entry. Administrators should consult the H3C Official Website for security advisories and firmware updates covering the Magic BE18000, NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510, NE36 Pro, and MC102G product lines.

Workarounds

Place affected H3C devices behind a segmented management VLAN accessible only from jump hosts.
Block inbound traffic to the device HTTP/HTTPS management interface at the network perimeter.
Where feasible, replace consumer-grade affected models with devices that have current vendor support and patches available.

bash

# Example ACL restricting /api/esps management access to a trusted subnet
# (adapt to your platform's syntax)
access-list MGMT permit tcp 10.10.0.0 0.0.0.255 host <device-ip> eq 443
access-list MGMT deny   tcp any host <device-ip> eq 443
access-list MGMT deny   tcp any host <device-ip> eq 80