CVE-2026-112370

9.9Critical

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-77, CWE-78

Impact

Remote attackers with low-privileged network access can execute arbitrary OS commands as root on the router. Public exploit code is already available.

Root cause

Improper input sanitization in the sub_416874 function within /usr/bin/usrlist allows command injection.

Affected systems

H3C Magic NX15 version 100R017.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Check the vendor support portal for a firmware update exceeding 100R017; if patching is not yet available, restrict router administrative interface access to trusted management networks only.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112370