H3C vulnerabilities
We track 74 vulnerabilities in H3C products across 39 products. 74 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest H3C vulnerabilities
- 9.9 Critical severity
Magic NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. T
- 9.9 Critical severity
Magic NX15: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made pu
- 9.8 Critical severity
CVM: Unrestricted Upload of File with Dangerous Type
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating t
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of
- 7.2 High severity
NX15: Exposed Dangerous Method or Function
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has bee
- 7.2 High severity
NX15: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit h
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The ve
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has
- 7.2 High severity
NX15: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The explo
- 7.3 High severity
NX15: Improper Authentication
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early ab
- 7.3 High severity
SecPath F1000-C8300: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. T
- 7.3 High severity
NX15: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak p
- 8.8 High severity
Magic B0: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the file /goform/aspForm. Such manipulation of the argument param leads to stack-based buffer overflow. The attack may be perf
- 8.8 High severity
Magic B0: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in H3C Magic B0 up to 100R002. This affects the function Edit_BasicSSID_5G of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. The attack may be initiated remotely. The exploit has
- 7.2 High severity
Magic B3: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The expl
- 8.8 High severity
Magic B1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. Remote exploitation of the a
- 8.8 High severity
Magic B1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the attack remote
- 8.8 High severity
Magic B0: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be executed remotely.
- 7.3 High severity
ACG1000-AK230: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit
- 8.8 High severity
Magic B1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function Edit_BasicSSID_5G of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be executed
- 9.8 Critical severity
Mc102-g Firmware: Incorrect Default Permissions
An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically
- 8.8 High severity
Magic B1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub_44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit
- 9.8 Critical severity
Magic B0: Buffer Copy without Checking Size of Input
A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has
- 8.8 High severity
Magic B3: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack can be initiated remotely. The exploit is pu
- 8.0 High severity
Magic Nx15 Firmware: Weak Password Requirements
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow f
- 7.0 High severity
M2 NAS: Execution with Unnecessary Privileges
A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The
- 7.5 High severity
Gr2200 Firmware: Uncontrolled Resource Consumption
In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.
- 8.8 High severity
GR-3000AX: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It
- 8.8 High severity
GR-5400AX: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The a
- 9.8 Critical severity
SecCenter SMP-E1114P02: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralF
- 7.5 High severity
SecCenter SMP-E1114P02: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDailyOut of the file /safeEvent/download. The manipulation of the argument filename leads to path traversa
- 7.5 High severity
SecCenter SMP-E1114P02: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible
- 7.5 High severity
SecCenter SMP-E1114P02: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been rated as problematic. This issue affects the function Download of the file /cfgFile/1/download. The manipulation of the argument Name leads to path traversal. The attack may be
- 7.5 High severity
SecCenter SMP-E1114P02: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been declared as problematic. This vulnerability affects the function downloadSoftware of the file /cfgFile/downloadSoftware. The manipulation of the argument filename leads to path
- 7.5 High severity
SecCenter SMP-E1114P02: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been classified as critical. This affects the function fileContent of the file /cfgFile/fileContent. The manipulation of the argument filePath leads to path traversal. It is possibl
- 9.8 Critical severity
GR-5400AX: Buffer Copy without Checking Size of Input
A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical. Affected by this issue is the function EditWlanMacList of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be
- 8.0 High severity
GR-5400AX: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to b
- 8.0 High severity
GR-1800AX: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. Access to the local network is
- 8.0 High severity
GR-3000AX: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability, which was classified as critical, was found in H3C GR-3000AX up to V100R006. Affected is the function EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit_List_SSID of the file /goform/aspForm of the component HTTP POST Request