CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-3854: H3C GR-3000AX HTTP POST Request aspForm Edit_List_SSID buffer overflow

8.6 CVSS

Description

A vulnerability, which was classified as critical, was found in H3C GR-3000AX up to V100R006. Affected is the function EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit_List_SSID of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to buffer overflow. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Other functions might be affected as well. Es wurde eine Schwachstelle in H3C GR-3000AX bis V100R006 gefunden. Sie wurde als kritisch eingestuft. Dabei betrifft es die Funktion EnableIpv6/UpdateWanModeMulti/UpdateIpv6Params/EditWlanMacList/Edit_List_SSID der Datei /goform/aspForm der Komponente HTTP POST Request Handler. Dank der Manipulation des Arguments param mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei im lokalen Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

Classification

CVE ID: CVE-2025-3854

CVSS Base Severity: HIGH

CVSS Base Score: 8.6

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem Types

Buffer Overflow Memory Corruption

Affected Products

Vendor: H3C

Product: GR-3000AX

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.09% (probability of being exploited)

EPSS Percentile: 27.52% (scored less or equal to compared to others)

EPSS Date: 2025-05-20 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: poc

SSVC Technical Impact: total

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-3854
https://vuldb.com/?id.305778
https://vuldb.com/?ctiid.305778
https://vuldb.com/?submit.556614
https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GR-3000AX/1.md
https://zhiliao.h3c.com/theme/details/229784
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/

Timeline