https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3701.htmlhttps://patchthecve.com/cve/CVE-2026-3701.htmlWed, 17 Jun 2026 10:44:02 +0000HIGH 8.8: A security vulnerability has been detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function Edit_BasicSSID_5G of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosehttps://patchthecve.com/cve/CVE-2025-60262.htmlhttps://patchthecve.com/cve/CVE-2025-60262.htmlWed, 17 Jun 2026 09:49:37 +0000CRITICAL 9.8: An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackhttps://patchthecve.com/cve/CVE-2025-14015.htmlhttps://patchthecve.com/cve/CVE-2025-14015.htmlSun, 18 Oct 2026 15:10:00 +0000HIGH 8.8: A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and cohttps://patchthecve.com/cve/CVE-2025-57295.htmlhttps://patchthecve.com/cve/CVE-2025-57295.htmlWed, 17 Jun 2026 09:43:00 +0000HIGH 8.0: H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can ehttps://patchthecve.com/cve/CVE-2025-44653.htmlhttps://patchthecve.com/cve/CVE-2025-44653.htmlSun, 05 Jul 2026 01:21:42 +0000HIGH 7.5: In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.https://patchthecve.com/cve/CVE-2025-5162.htmlhttps://patchthecve.com/cve/CVE-2025-5162.htmlWed, 17 Jun 2026 09:47:21 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralFile_2 leads to unrestricted upload. The https://patchthecve.com/cve/CVE-2025-5161.htmlhttps://patchthecve.com/cve/CVE-2025-5161.htmlWed, 17 Jun 2026 09:47:21 +0000MEDIUM 4.3: A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDailyOut of the file /safeEvent/download. The manipulation of the argument filename leads to path traversal. The attack can be launched remotely. https://patchthecve.com/cve/CVE-2025-5160.htmlhttps://patchthecve.com/cve/CVE-2025-5160.htmlWed, 17 Jun 2026 09:47:21 +0000MEDIUM 4.3: A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The explohttps://patchthecve.com/cve/CVE-2025-5159.htmlhttps://patchthecve.com/cve/CVE-2025-5159.htmlWed, 17 Jun 2026 09:47:21 +0000MEDIUM 4.3: A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been rated as problematic. This issue affects the function Download of the file /cfgFile/1/download. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely. The exploit has beehttps://patchthecve.com/cve/CVE-2025-5158.htmlhttps://patchthecve.com/cve/CVE-2025-5158.htmlWed, 17 Jun 2026 09:47:21 +0000MEDIUM 4.3: A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been declared as problematic. This vulnerability affects the function downloadSoftware of the file /cfgFile/downloadSoftware. The manipulation of the argument filename leads to path traversal. The attack can be initiated https://patchthecve.com/cve/CVE-2025-5157.htmlhttps://patchthecve.com/cve/CVE-2025-5157.htmlWed, 17 Jun 2026 09:47:20 +0000MEDIUM 4.3: A vulnerability was found in H3C SecCenter SMP-E1114P02 up to 20250513. It has been classified as critical. This affects the function fileContent of the file /cfgFile/fileContent. The manipulation of the argument filePath leads to path traversal. It is possible to initiate the attack remotely. The vhttps://patchthecve.com/cve/CVE-2025-5156.htmlhttps://patchthecve.com/cve/CVE-2025-5156.htmlWed, 17 Jun 2026 09:47:20 +0000HIGH 8.8: A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical. Affected by this issue is the function EditWlanMacList of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be launched remotely. The exploit has been https://patchthecve.com/cve/CVE-2025-3546.htmlhttps://patchthecve.com/cve/CVE-2025-3546.htmlWed, 17 Jun 2026 09:20:09 +0000HIGH 8.0: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST https://patchthecve.com/cve/CVE-2024-57473.htmlhttps://patchthecve.com/cve/CVE-2024-57473.htmlSun, 05 Jul 2026 01:21:18 +0000CRITICAL 9.8: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address editing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webshttps://patchthecve.com/cve/CVE-2024-57482.htmlhttps://patchthecve.com/cve/CVE-2024-57482.htmlSun, 05 Jul 2026 01:21:19 +0000CRITICAL 9.8: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request thttps://patchthecve.com/cve/CVE-2024-57480.htmlhttps://patchthecve.com/cve/CVE-2024-57480.htmlSun, 05 Jul 2026 01:21:18 +0000CRITICAL 9.8: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the AP configuration function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.https://patchthecve.com/cve/CVE-2024-57479.htmlhttps://patchthecve.com/cve/CVE-2024-57479.htmlSun, 05 Jul 2026 01:21:18 +0000CRITICAL 9.8: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address update function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.https://patchthecve.com/cve/CVE-2024-57471.htmlhttps://patchthecve.com/cve/CVE-2024-57471.htmlSun, 05 Jul 2026 01:21:17 +0000CRITICAL 9.8: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST requesthttps://patchthecve.com/cve/CVE-2024-52765.htmlhttps://patchthecve.com/cve/CVE-2024-52765.htmlWed, 17 Jun 2026 08:07:35 +0000CRITICAL 9.8: H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.https://patchthecve.com/cve/CVE-2024-42639.htmlhttps://patchthecve.com/cve/CVE-2024-42639.htmlWed, 17 Jun 2026 07:49:48 +0000CRITICAL 9.8: H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.https://patchthecve.com/cve/CVE-2024-42638.htmlhttps://patchthecve.com/cve/CVE-2024-42638.htmlWed, 17 Jun 2026 07:49:48 +0000CRITICAL 9.8: H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.https://patchthecve.com/cve/CVE-2024-42637.htmlhttps://patchthecve.com/cve/CVE-2024-42637.htmlWed, 17 Jun 2026 07:49:48 +0000CRITICAL 9.8: H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.