CVE-2026-112371
CriticalCVSS 9.9Summary
In H3C Magic NX15 NX15V100R017, the write function of /api/esps in the RPC Interface allows manipulation of the path argument to lead to code injection. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could execute arbitrary code on the device, taking control and compromising the network.
Recommendation
Update the device firmware to a vendor-fixed version or restrict access to the RPC interface from untrusted networks.
Other vulnerabilities in H3C Magic NX15
Original NVD description (English source)
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS