PT-2025-22308 · H3C · H3C Magic R200

Ch13Hh · Published 2025-05-20 · Updated 2025-05-21 · CVE-2025-4998

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions H3C Magic R200G versions up to 100R002

Description A vulnerability has been found in the HTTP POST Request Handler component, specifically affecting the function Edit BasicSSID, Edit BasicSSID 5G, SetAPWifiorLedInfoById, SetMobileAPInfoById, Asp SetTimingtimeWifiAndLed, AddMacList, EditMacList, AddWlanMacList, and EditWlanMacList of the file /goform/aspForm. The manipulation of the param argument leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For H3C Magic R200G versions up to 100R002, as a temporary workaround, consider restricting access to the /goform/aspForm file to minimize the risk of exploitation. Avoid using the param argument in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-4998

Affected Products

H3C Magic R200

References · 7

• 🔥 https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20Magic%20R200G/1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4998 · Security Note
• https://vuldb.com/?id.309649 · Note
• https://vuldb.com/?submit.563583 · Note
• https://vuldb.com/?ctiid.309649 · Note
• https://t.me/cvetracker/24352 · Telegram Post
• https://twitter.com/CVEnew/status/1924928778012115248 · Twitter Post