PT-2025-38476 · H3C · Nx15V100R015

N0Ps1Ed · Published 2025-09-18 · Updated 2025-09-19 · CVE-2025-57295

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions H3C devices versions NX15V100R015

Description H3C devices are susceptible to unauthorized access due to insecure default credentials. The root user account lacks a password, and the H3C user account utilizes the default password “admin”, both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.

Recommendations Change the default password for the H3C user account. Set a strong password for the root user account.

Exploit

Fix

LPE

Weakness Enumeration

CWE-1188

CWE-521

Related Identifiers

CVE-2025-57295

Affected Products

Nx15V100R015

References · 7

• 🔥 https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57295 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57295 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1968943663796363771 · Twitter Post
• https://t.me/CVEtracker/32882 · Telegram Post
• https://h3c.com/cn/d_202504/2407151_30005_0.htm · Note
• https://twitter.com/CVEnew/status/1969110925245595825 · Twitter Post