CVE-2025-60262

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-06 · updated 2026-06-17
Weakness: CWE-276

Description

An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices.

Affected products

H3C Magic Ba1500L Firmware: swba1a0v100r006
H3C Mc102-G Firmware: hm1a0v200r010

References

https://www.notion.so/23e54a1113e780d686fbe1624ee0465d
https://www.notion.so/Misconfiguration-in-H3C-23e54a1113e780d686fbe1624ee0465d

Get alerted when CVE-2025-60262 or the next vulnerability affects your stack