CVE-2024-13980CWE-502insecure-deserialization

CVE-2024-13980

published August 28, 2025

CVSS
10.0
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-28 UTC.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00961 · 61.2th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-08-28T02:15Z
References (6)
https://axsec.blog.csdn.net/article/details/141003376 · [email protected]https://blog.csdn.net/nnn2188185/article/details/141065540 · [email protected]https://blog.csdn.net/weixin_48539059/article/details/141033966 · [email protected]https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txt · [email protected]https://www.h3c.com/cn/Service/Online_Help/psirt/ · [email protected]https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rce · [email protected]
EPSS history
Timeline
  • 27 AUG 21:25Z
    H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
    cvelistv5