Overview
A critical remote command execution (RCE) vulnerability, identified as CVE-2025-63258, has been discovered in H3C ERG3/ERG5 series routers and XiaoBei series routers, cloud gateways, and wireless access points. This vulnerability allows a remote attacker to execute arbitrary commands on the affected devices. Given the potential impact, immediate action is recommended to mitigate the risk.
Technical Details
The vulnerability resides in how the affected H3C devices handle the sessionid parameter. Attackers can inject crafted commands into this parameter, which the router then executes with elevated privileges. Specifically, the affected versions include:
- ERG3/ERG5 series routers
- XiaoBei series routers, cloud gateways, and wireless access points
- Versions: R0162P07, UAP700-WPT330-E2265, UAP672-WPT330-R2262, UAP662E-WPT330-R2262P03, WAP611-WPT330-R1348-OASIS, WAP662-WPT330-R2262, WAP662H-WPT330-R2262, USG300V2-WPT330-R2129, MSG300-WPT330-R1350, and MSG326-WPT330-R2129
CVSS Analysis
As of the publication of this article, the Common Vulnerability Scoring System (CVSS) score for CVE-2025-63258 is currently N/A. However, given the nature of remote command execution vulnerabilities, it is expected to be a Critical severity vulnerability once assigned a score. We will update this section as soon as the official CVSS score is available.
Possible Impact
The successful exploitation of CVE-2025-63258 can have severe consequences, including:
- Complete System Compromise: Attackers can gain full control of the affected router.
- Data Breach: Sensitive data stored on or passing through the router can be compromised.
- Network Disruption: The router can be used to launch further attacks on the internal network or be taken offline, disrupting network services.
- Malware Installation: The router can be used as a foothold to install malware on other devices on the network.
Mitigation and Patch Steps
To mitigate the risk posed by CVE-2025-63258, the following steps are recommended:
- Apply the Patch: Check the H3C security advisory and apply the official patch or firmware update as soon as it becomes available.
- Disable Remote Management: If possible, disable remote management access to the router.
- Restrict Access: Limit access to the router’s management interface to trusted IP addresses only.
- Network Segmentation: Implement network segmentation to limit the impact of a successful attack.
- Monitor Network Traffic: Monitor network traffic for suspicious activity that may indicate an attempted exploitation.
References
- H3C Product Information: http://h3c.com
- H3C Security Advisory: https://zhiliao.h3c.com/Theme/details/232571
