Winmt

Name of the Vulnerable Software and Affected Versions: H3C ER2200G2 series routers versions prior to ERG2AW-MNW100-R1117 H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers versions prior to ERHMG2-MNW100-R1126 H3C GR3200, GR5200, GR8300 series routers versions prior to MiniGR1B0V100R018L50 H3C GR-1800AX series routers versions prior to MiniGRW1B0V100R009L50 H3C GR-3000AX series routers versions prior to SWBRW1A0V100R007L50 H3C GR-5400AX series routers versions prior to SWBRW1B0V100R009L50 Description: The issue concerns unauthorized remote command execution vulnerabilities. Attackers can bypass authentication by including specially crafted text in the request URL or message header and then inject arbitrary malicious commands into fields related to ACL access control list and user group functions to obtain the highest ROOT privileges of remote devices, thereby completely taking over the remote target devices. Recommendations: For H3C ER2200G2 series routers versions prior to ERG2AW-MNW100-R1117, update to a version after ERG2AW-MNW100-R1117. For H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers versions prior to ERHMG2-MNW100-R1126, update to a version after ERHMG2-MNW100-R1126. For H3C GR3200, GR5200, GR8300 series routers versions prior to MiniGR1B0V100R018L50, update to a version after MiniGR1B0V100R018L50. For H3C GR-1800AX series routers versions prior to MiniGRW1B0V100R009L50, update to a version after MiniGRW1B0V100R009L50. For H3C GR-3000AX series routers versions prior to SWBRW1A0V100R007L50, update to a version after SWBRW1A0V100R007L50. For H3C GR-5400AX series routers versions prior to SWBRW1B0V100R009L50, update to a version after SWBRW1B0V100R009L50.