PT-2026-1438 · Vsftpd+1 · Vsftpd+2

Published 2026-01-06 · Updated 2026-02-12 · CVE-2025-60262

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions H3C M102G HM1A0V200R010 wireless controller H3C BA1500L SWBA1A0V100R006 wireless access point

Description A misconfiguration exists in the vsftpd component of the affected devices. This allows remote attackers to gain root-level control over the devices by exploiting the FTP protocol. Specifically, any file uploaded anonymously via FTP is automatically assigned root ownership.

Recommendations For H3C M102G HM1A0V200R010 wireless controller, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For H3C BA1500L SWBA1A0V100R006 wireless access point, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-60262

Affected Products

H3C Ba1500L Swba1A0V100R006

H3C M102G Hm1A0V200R010

Vsftpd

References · 11

• 🔥 https://notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d · Exploit
• 🔥 https://notion.so/23e54a1113e780d686fbe1624ee0465d · Exploit
• https://osv.dev/vulnerability/CVE-2025-60262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60262 · Security Note
• https://twitter.com/vuldb/status/2008726666617778367 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/2009297458967261207 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008584279295443272 · Twitter Post
• https://twitter.com/CVEnew/status/2008565819169796126 · Twitter Post
• https://twitter.com/CveFindCom/status/2008579125355700371 · Twitter Post
• https://twitter.com/Komodosec/status/2022086960874189181 · Twitter Post
• https://t.me/pentestingnews/72173 · Telegram Post