H3C Magic Products Command Injection Vulnerability

A critical command injection vulnerability has been identified in several H3C Magic router models, including the NX15, NX30 Pro, NX400, R3010, and BE18000, all running versions prior to the latest release. The vulnerability resides in the HTTP POST request handler, specifically within the 'FCGI_CheckStringIfContainsSemicolon' function, where improper input handling allows for command injection. Exploitation of this vulnerability requires local network access.

Impact

Exploitation of this vulnerability allows for unauthorized command injection, potentially leading to arbitrary command execution on the affected device.

Remediation

Users are advised to upgrade to the latest version available for their specific router model. The updated versions can be downloaded from the H3C official website or through the H3C service app. For detailed upgrade instructions, please refer to the H3C partner resource center.