H3C Magic NX30 Pro and Magic NX400 Command Injection Vulnerability

A command injection vulnerability has been identified in the H3C Magic NX30 Pro and Magic NX400 routers, all versions prior to V100R014. The issue arises in the '/api/wizard/getNetworkConf' endpoint, where unauthorized manipulation can lead to execution of arbitrary commands on the device. This vulnerability requires local network access to exploit.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected router, with potential to disrupt network availability.

Reproduction

To reproduce this vulnerability, send a crafted POST request to the '/api/wizard/getNetworkConf' endpoint from within the local network. The request must be unauthorized, as the vulnerability does not require authentication.

Remediation

Users are advised to upgrade to version V100R014 or later. The updated version can be downloaded from the H3C website.