CVE-2025-60262

Critical

Published: 06/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

H3C M102G (HM1A0V200R010) and BA1500L (SWBA1A0V100R006) have a misconfiguration in vsftpd, causing all files uploaded anonymously via FTP to be owned by root. Remote attackers can gain root-level control over the devices.

Risk Assessment

Attackers can gain root privileges, leading to full device compromise and potentially the network.

Recommendation

Upgrade device firmware. Change vsftpd configuration so anonymous uploads are not owned by root.

Original NVD description (English source)

An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices.