PT-2025-32986 · H3C · H3C M2 Nas

Tpchecker · Published 2025-08-13 · Updated 2025-08-13 · CVE-2025-8907

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: H3C M2 NAS version V100R006

Description: A vulnerability exists in the Webserver Configuration component of H3C M2 NAS version V100R006. The vulnerability allows for execution with unnecessary privileges through manipulation. An attack must be initiated locally and is considered complex and difficult to exploit. The vendor states that the device lacks boa functionality and prevents anonymous file access. This vulnerability affects products no longer supported by the maintainer.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2025-8907

Affected Products

H3C M2 Nas

References · 8

• 🔥 https://notion.so/23f54a1113e7804bae88e76f9fb0cf5b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8907 · Security Note
• https://vuldb.com/?submit.624554 · Note
• https://twitter.com/CVEnew/status/1955658253540442281 · Twitter Post
• https://vuldb.com/?ctiid.319861 · Note
• https://t.me/CVEtracker/29875 · Telegram Post
• https://t.me/cveNotify/132039 · Telegram Post
• https://vuldb.com/?id.319861 · Note