CVE-2024-38902

The firmware of the H3C Magic R230 V100R002 device contains a fixed, predefined password stored in the /etc/shadow file responsible for storing system user authentication data. An attacker who knows or discovers this password (e.g., through firmware image analysis) can use it to log in to the root account directly on the device. Since the password is identical across all device instances with this software version, compromising one device allows attacks on all other devices with this firmware version.

An attacker gains full administrative (root) access to the device, enabling complete control over it, modification of network configuration, installation of malicious software, and potential use of the device as an entry point to the internal network (lateral movement).

Apply patches available from the manufacturer according to the references. As an interim measure, it is recommended to isolate the device from public network access, disable unnecessary remote access services, and monitor login attempts to the root account.

H3C Magic R230 with firmware version V100R002