SecuriTricks - CVE-2025-57295

Description

H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.

Product(s) Impacted

Vendor	Product	Versions
H3c	H3c Devices	NX15V100R015

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-521

Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	h3c	h3c_devices	NX15V100R015	/	/	/	/	/	/	/

References

https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md

https://www.h3c.com/cn/d_202504/2407151_30005_0.htm

CVSS Score

8.0 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: Sept. 18, 2025, 9:15 p.m.
Last Modified: Sept. 19, 2025, 4 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2025-57295