PT-2026-1438 · Vsftpd+1 · Vsftpd+2

Publicado 2026-01-06 · Atualizado 2026-02-12 · CVE-2025-60262

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions H3C M102G HM1A0V200R010 wireless controller H3C BA1500L SWBA1A0V100R006 wireless access point

Description A misconfiguration exists in the vsftpd component of the affected devices. This allows remote attackers to gain root-level control over the devices by exploiting the FTP protocol. Specifically, any file uploaded anonymously via FTP is automatically assigned root ownership.

Recommendations For H3C M102G HM1A0V200R010 wireless controller, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For H3C BA1500L SWBA1A0V100R006 wireless access point, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2025-60262

Produtos afetados

H3C Ba1500L Swba1A0V100R006

H3C M102G Hm1A0V200R010

Vsftpd

Referências · 11

• 🔥 https://notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d · Exploit
• 🔥 https://notion.so/23e54a1113e780d686fbe1624ee0465d · Exploit
• https://twitter.com/vuldb/status/2008726666617778367 · Publicação no Twitter
• https://twitter.com/Karma_X_Inc/status/2009297458967261207 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-60262 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2008584279295443272 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008565819169796126 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2008579125355700371 · Publicação no Twitter
• https://twitter.com/Komodosec/status/2022086960874189181 · Publicação no Twitter
• https://t.me/pentestingnews/72173 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-60262 · Nota de Segurança