CVE-2025-29296

CVE-2025-29296 is a command injection vulnerability in H3C's /api/esps handler affecting at least eight device models in the H3C Magic product line. The vulnerability allows unauthenticated attackers to execute arbitrary shell commands via the management interface by injecting payloads into API method parameters that get passed directly to eval(). The CVSS 9.8 score is accurate and well-deserved — this is straightforward remote code execution with no authentication required. The critical insight here is not the eight listed models but what they represent. All eight share identical eval injection patterns across unrelated interfaces (dhcpd.vlan, filter.url, apcm.version, swcm.version, system.ntp). This is not coincidental parallel development — it points to a shared API dispatcher framework where the eval vulnerability is baked into the dispatch layer itself, meaning any future endpoint added to any device using this framework inherits the vulnerability by default. The EPSS score of 0.0224 significantly understates the real-world risk. H3C is a dominant player in enterprise and ISP edge networking. These devices are typically always-on, rarely patched, and often have management interfaces exposed to WAN either by default or through common provisioning misconfigurations. If you can reach the /api/esps handler from the internet, this becomes mass-harvestable RCE rather than a requiring-LAN-access vulnerability. On firmware integrity: most H3C enterprise devices implement ARM TrustZone, but the management interface runs in the non-secure world — code execution via this CVE occurs outside the trusted execution environment. Achieving persistent root requires filesystem modification, which is typically trivial once you have root. Don't rely on firmware signing to save compromised devices. For defenders: verify whether your H3C devices have the management interface exposed to untrusted networks — this is the decisive risk factor. Check firmware version against H3C advisories, but understand that many SOHO/SMB devices in this class never receive patches after initial release. Assume the eight listed models are a subset of a much larger exposure that likely includes enterprise product lines sharing the same API framework.

Reviewed through automated stages and approved by a human before publication.