CVE-2025-60262: Critical Misconfiguration in H3C Wireless Gear Hands Control to Hackers

CVE-2025-60262 exposes a critical misconfiguration in certain H3C wireless controllers and access points, where anonymous FTP uploads can be owned by root, enabling remote attackers to seize root-level control of the devices. The flaw stems from misconfiguring the vsftpd service: chown_uploads is enabled, but the corresponding chown_username setting was not configured, and, per the vsftpd documentation, the default for chown_username is root if not specified.

The advisory warns that using root for uploaded files is not recommended, and the result is that all files uploaded anonymously via FTP are automatically owned by root, permitting privilege escalation. Affected products include the H3C M102G Wireless Controller (firmware HM1A0V200R010) and the BA1500L Wireless Access Point (firmware SWBA1A0V100R006). Administrators are urged to check firmware and await a vendor patch to correct the configuration error, with the issue rated at a CVSS of 9.8. According to the article, “It allows remote attackers with anonymous FTP access to gain root-level control over the devices.”