H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
References
| Link | Resource |
|---|---|
| https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md | Exploit Third Party Advisory |
| https://www.h3c.com/cn/d_202504/2407151_30005_0.htm | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Oct 2025, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
H3c
H3c magic Nx15 H3c magic Nx15 Firmware |
|
| References | () https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md - Exploit, Third Party Advisory | |
| References | () https://www.h3c.com/cn/d_202504/2407151_30005_0.htm - Product | |
| CPE | cpe:2.3:o:h3c:magic_nx15_firmware:nx15v100r015:*:*:*:*:*:*:* cpe:2.3:h:h3c:magic_nx15:-:*:*:*:*:*:*:* |
19 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| CWE | CWE-521 CWE-1188 |
18 Sep 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-18 21:15
Updated : 2025-10-03 17:23
NVD link : CVE-2025-57295
Mitre link : CVE-2025-57295
CVE.ORG link : CVE-2025-57295
JSON object : View
Products Affected
h3c
- magic_nx15_firmware
- magic_nx15