PT-2025-42510 · H3C · H3C Magic

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-61330

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions H3C Magic-branded devices (affected versions not specified)

Description A security issue exists in H3C Magic-branded devices due to a hard-coded weak password for the root account, or the absence of a password, in the /etc/shadow configuration. The Telnet service is enabled by default or can be enabled through device management interfaces such as /debug.asp or /debug telnet.asp. Virtual Servers can map the devices to the public network, increasing the risk of remote attacks. Attackers can potentially gain root privileges through the Telnet service using the weak password or by exploiting the lack of a password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2025-61330

Affected Products

H3C Magic

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-61330 · Security Note
• https://notion.so/25e8cd7f7805800a9a71c1193fb3cb43 · Note
• https://t.me/CVEtracker/35124 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1979020667774210212 · Twitter Post
• https://twitter.com/CVEnew/status/1978932568704823447 · Twitter Post