PT-2025-34939 · H3C · H3C Intelligent Management Center

Published 2025-08-27 · Updated 2025-08-27 · CVE-2024-13980

Positive Technologies · (AI Summary)

CVSS v4.0

10

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions:

H3C Intelligent Management Center (IMC) versions up to and including E0632H07

Description:

H3C Intelligent Management Center (IMC) contains a remote command execution issue in the `/byod/index.xhtml` endpoint. Improper handling of the `javax.faces.ViewState` parameter allows unauthenticated attackers to craft POST requests with forged parameters, potentially leading to arbitrary command execution. This issue does not require authentication or session cookies.

Recommendations:

Update to a version later than E0632H07.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-13980

Affected Products

H3C Intelligent Management Center

References · 9

• 🔥 https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txt · Exploit
• 🔥 https://blog.csdn.net/weixin_48539059/article/details/141033966 · Exploit
• 🔥 https://blog.csdn.net/nnn2188185/article/details/141065540 · Exploit
• 🔥 https://axsec.blog.csdn.net/article/details/141003376 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13980 · Security Note
• https://vulncheck.com/advisories/h3c-intelligent-management-center-rce · Note
• https://t.me/CVEtracker/31077 · Telegram Post
• https://h3c.com/cn/Service/Online_Help/psirt · Note
• https://twitter.com/CVEnew/status/1960820579516473735 · Twitter Post