CVE-2025-5162 json
H3C SecCenter SMP-E1114P02 importFile unrestricted upload
published 2025-05-26 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16253
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralFile_2 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- flowus.cn https://flowus.cn/share/d6c310ac-a179-499f-9e9a-5c0de80b19be?code=G8A6P3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- H3C SecCenter SMP-E1114P02
Classification
References
-
flowus.cn
/share/d6c310ac-a179-499f-9e9a-5c0de80b19be?code=G8A6P3
exploit, permissions-required
-
vuldb.com
/?id.310250
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.310250
signature, permissions-required, vdb-entry
-
vuldb.com
/?submit.578679
third-party-advisory, vdb-entry
-
flowus.cn
/share/ce6c4094-8d97-466c-8fcc-df3f3d6f314e?code=G8A6P3
related, permissions-required
Sources
- CVE List CVE-2025-5162
- NVD CVE-2025-5162
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.