CVE-2025-60262 is a critical misconfiguration vulnerability affecting H3C M102G wireless controllers and BA1500L wireless access points. The vulnerability stems from vsftpd, where anonymously uploaded files are automatically owned by the root user. This allows remote, unauthenticated attackers to gain root-level control over the affected devices. With a CVSS score of 9.8 (Critical), the attack requires no user interaction or prior authentication, making it easily exploitable with high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
hm1a0v200r010CPE matchmatch criteria | cpe:2.3:o:h3c:mc102-g_firmware:hm1a0v200r010:*:*:*:*:*:*:* | ||
swba1a0v100r006CPE matchmatch criteria | cpe:2.3:o:h3c:magic_ba1500l_firmware:swba1a0v100r006:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.