TI-2022-11541 Aliases CVE-2022-28940 GHSA-94f9-9q8r-v9qg

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without…

LOW 35Published 2022-05-04 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out DOS attack.

Why it matters now

EPSS 0.01183 67th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:h3c:magic_r100_firmware::::::::	up to v100r005	Vulnerable	H3C
cpe:2.3:h:h3c:magic_r100:-:::::::*	not specified by NVD	Running on	H3C

cpe:2.3:o:h3c:magic_r100_firmware:*:*:*:*:*:*:*:* Versions up to v100r005 Vulnerable ·H3C
cpe:2.3:h:h3c:magic_r100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·H3C

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-28940
2026-10-03 Alias added: GHSA-94f9-9q8r-v9qg

References

Exploit 1

https://github.com/zhefox/0day/blob/main/%E6%96%B0%E5%8D%8E%E4%B8%89magicR100%E5%AD%98%E5%9C%A8DOS%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md

TI-2023-12428 H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the… CVSS 3.1MEDIUM 4.9
TI-2022-15436 The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing… CVSS 3.1CRITICAL 9.8
TI-2022-12991 H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2022-12990 H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2022-12989 H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2022-12988 H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via… CVSS 3.1CRITICAL 9.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences