High severity · published Jun 15, 2025
CVE-2025-6090
H3C GR-5400AX aspForm UpdateIpv6params buffer overflow
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, they do not have immediate plans for remediation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
GR-5400AX · H3C
V100R009L50 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6090
github.com
https://github.com/CH13hh/cve/blob/main/new/5.md
vuldb.com
https://vuldb.com/?ctiid.312557
vuldb.com
https://vuldb.com/?id.312557
vuldb.com
https://vuldb.com/?submit.587999
More from GR-5400AX
9.8
CVE-2025-5156
H3C GR-5400AX aspForm EditWlanMacList buffer overflow
8.0
CVE-2025-4446
H3C GR-5400AX aspForm Edit_List_SSID buffer overflow
