Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2025-4997: H3C R2+ProG Configuration Tool Crashes on Malformed Input
CVE-2025-4997 · published 1 year ago
Summary
A weakness in the H3C R2+ProG configuration tool could cause it to crash if it receives specially crafted input. This could be exploited remotely, potentially disrupting service. Update to the latest version of the tool to fix this issue.
Original advisory text
A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit_Bas...
A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit_BasicSSID/Edit_GuestSSIDFor2P4G/Edit_BasicSSID_5G/SetAPInfoById of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-404Improper Resource Shutdown or Release
Timeline
Published20 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-4997 · NVD
Track software like this
Free during beta