External risk intelligence

H3C Wireless Controller and Access Point FTP Misconfiguration Allows Root Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60262

The vulnerability affects wireless controllers and access points. These networking devices are commonly deployed at the edge of networks to manage traffic. Since the vulnerability involves FTP services, which may be exposed on such appliances, there is a strong likelihood that the attack surface is reachable via the network in common deployment configurations.

H3c Mc102 G Firmware

hm1a0v200r010swba1a0v100r006

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in H3C wireless controllers and access points. This issue stems from a misconfiguration in the FTP service, potentially allowing anonymous file uploads to be owned by the root user, which could enable remote attackers to gain root-level control of the devices.

Misconfigured FTP allows root control.
Critical network devices are vulnerable.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain unauthorized root-level control over network devices by exploiting a misconfiguration in the FTP service. This vulnerability allows any files uploaded anonymously via FTP to be automatically assigned to the root user, effectively granting the attacker privileged access and the ability to execute commands with administrative privileges on the affected devices.

No authentication required to access.
Anonymous file uploads to FTP.
Root-level control over devices.

Live Threat

Current exploitation, exposure, and threat context

A misconfiguration in the FTP service on H3C wireless controllers and access points could allow remote attackers to gain root-level control over the devices. This occurs when files uploaded anonymously via FTP are automatically assigned to the root user, potentially leading to unauthorized access and modification of device configurations or data.

Root-level control of devices.
Anonymous FTP uploads.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, infrastructure and network teams are likely responsible for securing these H3C wireless controllers and access points. The initial action should be to identify all deployed instances of the affected devices, determine their network reachability and business criticality, pinpoint the accountable owner for each device, and then plan remediation based on the assessed risk.

Infrastructure and network teams own resolution.
Verify device network exposure and criticality.
Plan vendor coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the H3C M102G and BA1500L equipment used for?

These devices are networking components. The M102G functions as a wireless controller to manage connectivity, while the BA1500L acts as a wireless access point. Organizations use them to build and oversee local network infrastructure, providing the hardware layer that allows devices to connect to the network and manage traffic flow.

What does CWE-276 mean for CVE-2025-60262?

This vulnerability is classified as CWE-276, which refers to Incorrect Default Permissions. In this case, the FTP service is misconfigured to trust files uploaded anonymously. When a file is uploaded, the system incorrectly assigns ownership to the root user, which is the highest level of administrative privilege on the device. This allows a file to behave as a privileged process or configuration, bypassing standard security restrictions.

How is the FTP vulnerability triggered?

The issue is triggered when an attacker uses the anonymous FTP upload feature on an affected device. Because no authentication is required, an attacker can simply upload a file to the system. This trigger path does not require any existing user credentials or prior access to the device. However, normal device operations that do not involve anonymous FTP file transfers are not impacted by this specific misconfiguration.

Why does Halo Surface Signal flag this as relevant?

Halo Surface Signal flags this as a priority because these devices are often placed at the network edge to manage traffic, making their services more likely to be reachable from outside the internal network. If the FTP service is accessible over the network, it creates a direct path for an unauthorized party to attempt an upload and potentially compromise the entire device.

How should I respond if I use these H3C products?

Begin by creating an inventory of all H3C M102G and BA1500L devices in your environment. Determine which of these units are reachable over the network, as those are at higher risk. Identify the teams responsible for these assets and coordinate with them to check for manufacturer updates or configuration changes that can disable anonymous FTP access until a permanent fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.