PT-2025-26438 · H3C · Er6300G2+14

Winmt + 1 · Published 2025-06-20 · Updated 2025-06-21 · CVE-2025-44635

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: H3C ER2200G2 series routers versions prior to ERG2AW-MNW100-R1117 H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers versions prior to ERHMG2-MNW100-R1126 H3C GR3200, GR5200, GR8300 series routers versions prior to MiniGR1B0V100R018L50 H3C GR-1800AX series routers versions prior to MiniGRW1B0V100R009L50 H3C GR-3000AX series routers versions prior to SWBRW1A0V100R007L50 H3C GR-5400AX series routers versions prior to SWBRW1B0V100R009L50

Description: The issue concerns unauthorized remote command execution vulnerabilities. Attackers can bypass authentication by including specially crafted text in the request URL or message header and then inject arbitrary malicious commands into fields related to ACL access control list and user group functions to obtain the highest ROOT privileges of remote devices, thereby completely taking over the remote target devices.

Recommendations: For H3C ER2200G2 series routers versions prior to ERG2AW-MNW100-R1117, update to a version after ERG2AW-MNW100-R1117. For H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers versions prior to ERHMG2-MNW100-R1126, update to a version after ERHMG2-MNW100-R1126. For H3C GR3200, GR5200, GR8300 series routers versions prior to MiniGR1B0V100R018L50, update to a version after MiniGR1B0V100R018L50. For H3C GR-1800AX series routers versions prior to MiniGRW1B0V100R009L50, update to a version after MiniGRW1B0V100R009L50. For H3C GR-3000AX series routers versions prior to SWBRW1A0V100R007L50, update to a version after SWBRW1A0V100R007L50. For H3C GR-5400AX series routers versions prior to SWBRW1B0V100R009L50, update to a version after SWBRW1B0V100R009L50.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-44635

Affected Products

Er2200G2

Er3100G2

Er3200G2

Er3260G2

Er5100G2

Er5200G2

Er6300G2

Er8300G2

Er8300G2-X

Gr-1800Ax

Gr-3000Ax

Gr-5400Ax

Gr3200

Gr5200

Gr8300

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-44635 · Security Note
• https://zhiliao.h3c.com/Theme/details/230461 · Note
• https://twitter.com/CVEnew/status/1936508737843503521 · Twitter Post
• https://h3c.com/cn/Service/Online_Help/psirt/security-notice/detail_2021.htm?Id=459 · Note