An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices.
References
| Link | Resource |
|---|---|
| https://www.notion.so/23e54a1113e780d686fbe1624ee0465d | Exploit Third Party Advisory |
| https://www.notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d | Exploit Third Party Advisory |
Configurations
History
29 Jan 2026, 01:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
H3c mc102-g
H3c magic Ba1500l H3c H3c magic Ba1500l Firmware H3c mc102-g Firmware |
|
| References | () https://www.notion.so/23e54a1113e780d686fbe1624ee0465d - Exploit, Third Party Advisory | |
| References | () https://www.notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:h:h3c:mc102-g:-:*:*:*:*:*:*:* cpe:2.3:h:h3c:magic_ba1500l:-:*:*:*:*:*:*:* cpe:2.3:o:h3c:magic_ba1500l_firmware:swba1a0v100r006:*:*:*:*:*:*:* cpe:2.3:o:h3c:mc102-g_firmware:hm1a0v200r010:*:*:*:*:*:*:* |
06 Jan 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-06 16:15
Updated : 2026-01-29 01:36
NVD link : CVE-2025-60262
Mitre link : CVE-2025-60262
CVE.ORG link : CVE-2025-60262
JSON object : View
Products Affected
h3c
- magic_ba1500l
- magic_ba1500l_firmware
- mc102-g
- mc102-g_firmware
CWE
CWE-276
Incorrect Default Permissions