CVE-2026-112370

CriticalCVSS 9.9

Published: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

In H3C Magic NX15 100R017, the function sub_416874 in /usr/bin/usrlist allows OS command injection. Remote exploitation is possible, and the exploit has been made public.

Risk Assessment

An attacker could remotely execute system commands, leading to device takeover and potential network access.

Recommendation

Update the firmware to a patched version or restrict access to the vulnerable function from external networks.

Other vulnerabilities in H3C Magic NX15

CVE-2026-112371Critical
In H3C Magic NX15 NX15V100R017, the write function of /api/esps in the RPC Interface allows manipulation of the path argument to lead to code injection. The attack can be executed remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS