CVE-2025-60262 Misconfiguration in n/a
Remote attackers can gain root control by uploading files via anonymous FTP due to a vsftpd misconfiguration on H3C wireless devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-60262?
CVE-2025-60262 is a critical vulnerability in n/a, published on 6 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices.
Weakness: CWE-276
Which versions are affected by CVE-2025-60262?
It affects 2 products.
Products include H3c Magic Ba1500l Firmware, H3c Mc102-G Firmware.
How do I fix CVE-2025-60262?
No fix has been published for CVE-2025-60262 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-60262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60262 exists.
Sources
Also known as GHSA-r36f-vrxf-7jf9.