PT-2025-20437 · H3C · H3C Gr-1800Ax

Babyshark · Published 2025-05-08 · Updated 2025-05-09 · CVE-2025-4440

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions H3C GR-1800AX versions up to 100R008

Description A critical issue was found, affecting the function EnableIpv6 of the file "/goform/aspForm". The manipulation of the argument param leads to a buffer overflow. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

Recommendations For H3C GR-1800AX versions up to 100R008, consider disabling the EnableIpv6 function of the "/goform/aspForm" file as a temporary workaround until a patch is available. Restrict access to the local network to minimize the risk of exploitation. Avoid using the param argument in the affected file until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2025-4440

Affected Products

H3C Gr-1800Ax

References · 11

• 🔥 https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GR-1800AX/1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4440 · Security Note
• https://t.me/cvetracker/23416 · Telegram Post
• https://vuldb.com/?id.308048 · Note
• https://vuldb.com/?ctiid.308048 · Note
• https://twitter.com/CVEnew/status/1920618684638507169 · Twitter Post
• https://vuldb.com/?submit.557087 · Note
• https://twitter.com/CveFindCom/status/1920752060317753388 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1920664376496865492 · Twitter Post
• https://twitter.com/cybercronai/status/1920945712151282132 · Twitter Post
• https://t.me/cvedetector/24874 · Telegram Post