H3C Magic Products Command Injection Vulnerability

A command injection vulnerability has been identified in several H3C Magic home router models, including the NX15, NX30 Pro, NX400, R3010, and BE18000, all through specific versions. The vulnerability resides in the HTTP POST request handler, specifically within the 'FCGI_CheckStringIfContainsSemicolon' function, where improper input validation allows for command injection. This issue can only be exploited from within the local network.

Impact

Exploitation of this vulnerability allows for unauthorized command injection, potentially leading to arbitrary command execution on the affected device.

Remediation

Users are advised to upgrade to the latest firmware versions available on the H3C website. For specific upgrade instructions, refer to the H3C software download page.