CVE-2025-5156 is a high severity (CVSS 8.8) buffer overflow in the EditWlanMacList function of the H3C GR-5400AX router firmware, versions up to 100R008. The record says it can be attacked remotely. No fixed version is confirmed, so check with H3C and restrict management access now.
What's affected
H3C GR-5400AX firmware up to and including 100R008, per the record. The vulnerable function is EditWlanMacList, reached through /routing/goform/aspForm, and the weak input is the param argument. The record says the vendor was contacted early and did not respond.
The record names no patched release. The reference is a researcher write-up and a VulDB entry, not a vendor advisory. I could not confirm a fixed firmware, so check H3C's support site for your hardware revision before assuming one exists.
The vector lists a low privilege account as the access needed. On a router, that usually means a valid login to the management interface, which makes exposure of that interface the key question.
How to check if you're exposed
Read the firmware version in the router's management page, usually under system or about. If it reads 100R008 or earlier, treat it as affected.
Then check where the management interface listens. From a machine outside your network, a management page that answers on the router's public address is the worst case. Check the port forwarding and remote management settings in the router itself.
For a fleet, ask your network team for an inventory of H3C devices with firmware versions. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Identify every GR-5400AX and record its firmware version.
- Turn off remote management from the internet, and limit the management interface to a trusted internal address or VPN.
- Change default and shared admin passwords, and remove accounts that are not needed.
- Contact H3C for a fixed firmware and ask for a date. Apply it as soon as it exists.
- If a device cannot be fixed or isolated, plan its replacement.
Why it matters
The record lists CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow). In a buffer overflow, the firmware copies input into a fixed block of memory without checking the length. The consequence can range from a crash to a change in what the device runs, and the high impact scores in the vector (confidentiality, integrity and availability all rated high) reflect that.
A router sits between your network and everything else, so a compromise there is more than one lost device. Traffic can be watched or redirected. The practical defence while no fix exists is to shrink who can reach the management interface.
The record says the exploit has been disclosed publicly. It does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
Is there a firmware fix for the GR-5400AX?
I could not confirm one. The record lists no fixed version, and the vendor did not respond to the researcher per the record. Check H3C's support pages.
Does an attacker need to log in?
The CVSS vector lists a low privilege account as required, so a valid login to the management interface is expected. Keep that interface off the internet.
Sources
Last reviewed: 18 October 2026.
