PT-2025-47366 · H3C · H3C Msg326-Wpt330-R2129+12

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-63258

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions H3C ERG3/ERG5 series routers H3C XiaoBei series routers H3C cloud gateways H3C wireless access points versions R0162P07 H3C wireless access points version UAP700-WPT330-E2265 H3C wireless access points version UAP672-WPT330-R2262 H3C wireless access points version UAP662E-WPT330-R2262P03 H3C wireless access points version WAP611-WPT330-R1348-OASIS H3C wireless access points version WAP662-WPT330-R2262 H3C wireless access points version WAP662H-WPT330-R2262 H3C USG300V2-WPT330-R2129 H3C MSG300-WPT330-R1350 H3C MSG326-WPT330-R2129

Description A remote command execution (RCE) issue exists in H3C ERG3/ERG5 series routers, XiaoBei series routers, cloud gateways, and wireless access points. Successful exploitation allows attackers to inject crafted commands via the sessionid parameter, potentially leading to arbitrary code execution on the affected systems.

Recommendations Versions R0162P07 should be updated to a newer, secure version. Version UAP700-WPT330-E2265 should be updated to a newer, secure version. Version UAP672-WPT330-R2262 should be updated to a newer, secure version. Version UAP662E-WPT330-R2262P03 should be updated to a newer, secure version. Version WAP611-WPT330-R1348-OASIS should be updated to a newer, secure version. Version WAP662-WPT330-R2262 should be updated to a newer, secure version. Version WAP662H-WPT330-R2262 should be updated to a newer, secure version. Version USG300V2-WPT330-R2129 should be updated to a newer, secure version. Version MSG300-WPT330-R1350 should be updated to a newer, secure version. Version MSG326-WPT330-R2129 should be updated to a newer, secure version.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-63258

Affected Products

H3C Erg3/Erg5 Series Routers

H3C Msg300-Wpt330-R1350

H3C Msg326-Wpt330-R2129

H3C Usg300V2-Wpt330-R2129

H3C Xiaobei Series Routers

H3C Cloud Gateways

H3C Wireless Access Points Version Uap662E-Wpt330-R2262P03

H3C Wireless Access Points Version Uap672-Wpt330-R2262

H3C Wireless Access Points Version Uap700-Wpt330-E2265

H3C Wireless Access Points Version Wap611-Wpt330-R1348-Oasis

H3C Wireless Access Points Version Wap662-Wpt330-R2262

H3C Wireless Access Points Version Wap662H-Wpt330-R2262

H3C Wireless Access Points Versions R0162P07

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-63258 · Security Note
• http://h3c.com · Note
• https://t.me/CVEtracker/37648 · Telegram Post
• https://twitter.com/CVEnew/status/1991066225720562111 · Twitter Post
• http://er3200g3x.com · Note
• https://zhiliao.h3c.com/Theme/details/232571 · Note
• https://t.me/cveNotify/143344 · Telegram Post