CVE-2026-112371
9.9CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-74, CWE-94
Impact
Authenticated remote attackers can achieve arbitrary code execution with root privileges on the device. Exploitation requires network access and low-privileged credentials to reach the web RPC interface.
Root cause
Improper input sanitization of the path argument in the /api/esps RPC write function allows arbitrary file writes leading to code injection.
Affected systems
H3C Magic NX15 version NX15V100R017.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
No patched firmware version is listed yet; block network access to the web management interface and restrict access to trusted admin IPs immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.