CVE-2025-3546: H3C Magic NX15 Firmware RCE Vulnerability

CVE-2025-3546 Overview

CVE-2025-3546 is a command injection vulnerability affecting multiple H3C Magic series consumer routers, including the Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, and Magic BE18000 up to firmware version V100R014. The flaw resides in the FCGI_CheckStringIfContainsSemicolon function invoked by the /api/wizard/getLanguage endpoint within the HTTP POST request handler. An adjacent attacker with low privileges can manipulate request parameters to inject arbitrary operating system commands. The exploit has been publicly disclosed, increasing the risk of opportunistic attacks against exposed devices on local networks.

Critical Impact
Successful exploitation grants adjacent network attackers arbitrary command execution on the router, enabling full device compromise, traffic interception, and lateral movement into internal networks.

Affected Products

H3C Magic NX15, Magic NX30 Pro, and Magic NX400 firmware up to V100R014
H3C Magic R3010 firmware up to V100R014
H3C Magic BE18000 firmware up to V100R014

Discovery Timeline

2025-04-14 - CVE-2025-3546 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3546

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected router firmware exposes a FastCGI-backed HTTP POST endpoint at /api/wizard/getLanguage. This endpoint calls FCGI_CheckStringIfContainsSemicolon, a function intended to validate that user-supplied input does not contain shell metacharacters before the value is passed to a downstream shell interpreter.

The validation logic is insufficient. Attackers can craft input that bypasses the semicolon check and reaches an underlying command execution primitive. The result is arbitrary OS command execution in the context of the router's web service, which on consumer routers typically runs with elevated privileges.

Exploitation requires access to the local or adjacent network segment where the router's management interface is reachable. Authentication requirements are low, and no user interaction is needed. A public proof-of-concept has been disclosed, and the EPSS score is 1.527% (72.5 percentile), reflecting elevated exploitation likelihood relative to average CVEs.

Root Cause

The root cause is incomplete input sanitization in FCGI_CheckStringIfContainsSemicolon. The function inspects for a narrow set of forbidden characters instead of enforcing a strict allowlist. Shell metacharacters other than the semicolon, such as backticks, pipes, dollar-parenthesis substitutions, and ampersands, are not filtered and remain viable injection vectors.

Attack Vector

An attacker on the adjacent network sends a crafted HTTP POST request to /api/wizard/getLanguage. The request body contains a language parameter appended with shell metacharacters and a payload command. When the parameter reaches the vulnerable handler, the payload is executed by the underlying shell. Refer to the GitHub Gist PoC Repository and VulDB #304585 - Details for exploitation specifics.

Detection Methods for CVE-2025-3546

Indicators of Compromise

HTTP POST requests to /api/wizard/getLanguage containing shell metacharacters such as backticks, pipes, $(, or && in body parameters
Unexpected outbound connections originating from the router management IP shortly after HTTP requests to the wizard API
New or modified processes on the router such as telnetd, nc, or wget invocations spawned by the FastCGI worker

Detection Strategies

Inspect network traffic on management VLANs for HTTP POST requests targeting /api/wizard/ endpoints with anomalous payloads
Correlate router web service access logs with subsequent configuration changes or firmware modifications
Alert on DNS resolutions or outbound HTTP requests initiated by router interfaces to attacker-controlled infrastructure

Monitoring Recommendations

Enable syslog forwarding from H3C Magic devices to a central log platform and retain HTTP request logs
Baseline normal administrative traffic patterns and alert on off-hours access to the router web UI
Monitor for the addition of unauthorized SSH keys, cron entries, or user accounts on managed network devices

How to Mitigate CVE-2025-3546

Immediate Actions Required

Upgrade affected H3C Magic devices to firmware versions later than V100R014 as released by the vendor
Restrict access to the router administrative interface to trusted management VLANs or hosts only
Disable remote management from the WAN interface if it is not required for operations
Rotate all router administrative credentials after patching to invalidate any credentials captured pre-patch

Patch Information

H3C has published mitigation guidance at H3C Resource Details. Updated firmware images are available through H3C Software Downloads. Administrators should apply the latest firmware for each affected model and verify the running version after reboot.

Workarounds

Segment consumer routers onto isolated management networks and block adjacent-network access to TCP ports serving the web UI
Deploy firewall rules that drop HTTP POST requests to /api/wizard/getLanguage from untrusted internal hosts until firmware is patched
Replace end-of-life or unsupported H3C Magic devices with actively maintained models if a firmware fix is not available for a given SKU

bash

# Example ACL restricting router management access to a trusted subnet
acl number 3000
 rule 5 permit tcp source 10.10.10.0 0.0.0.255 destination-port eq 80
 rule 10 permit tcp source 10.10.10.0 0.0.0.255 destination-port eq 443
 rule 15 deny tcp destination-port eq 80
 rule 20 deny tcp destination-port eq 443
interface GigabitEthernet0/0
 packet-filter 3000 inbound