CVE-2026-3943 | H3C ACG1000-AK230 up to 20260227 ?aaa_portal_auth_local_submit suffix command injection

A vulnerability, which was classified as critical, was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit. The manipulation of the argument suffix results in command injection.

This vulnerability is reported as CVE-2026-3943. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.