A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. The vulnerability stems from the use of a hard-coded weak password for the root account in the /etc/shadow configuration or even the absence of any password at all. Some of these devices have the Telnet service enabled by default, or users can choose to enable the Telnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices have related interfaces called Virtual Servers, which can map the devices to the public network, posing the risk of remote attacks. Therefore, attackers can obtain the highest root privileges of the devices through the Telnet service using the weak password hardcoded in the firmware (or without a password), and remote attacks are possible.
References
| Link | Resource |
|---|---|
| https://www.notion.so/25e8cd7f7805800a9a71c1193fb3cb43 |
Configurations
No configuration.
History
16 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-259 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
16 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-16 18:15
Updated : 2025-10-21 19:31
NVD link : CVE-2025-61330
Mitre link : CVE-2025-61330
CVE.ORG link : CVE-2025-61330
JSON object : View
Products Affected
No product.
CWE
CWE-259
Use of Hard-coded Password