Vulnerability details
CVE-2025-4998
H3C Magic R200G
H3C Magic R200G HTTP POST Request aspForm EditWlanMacList denial of service
CVSS 4.0
7.1High
Official description
A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Edit_BasicSSID_5G/SetAPWifiorLedInfoById/SetMobileAPInfoById/Asp_SetTimingtimeWifiAndLed/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 6.5Medium | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 6.5Medium | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 6.8Medium | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| H3C | Magic R200G | 100R002 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://vuldb.com/?id.309649 vdb-entrytechnical-description
- https://vuldb.com/?ctiid.309649 signaturepermissions-required
- https://vuldb.com/?submit.563583 third-party-advisory
- https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20Magic%20R200G/1.md broken-linkexploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-05-21
- Last updated
- 2025-05-21
- State
- Published
- Assigner (CNA)
- VulDB
Exploit prediction (EPSS)
0.56%
Probability of exploitation in 30 days
47%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-404Denial of Service