CVE-2026-18810
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A security vulnerability has been detected in H3C NX15 V100R017. An unknown function in the file /api/wizard/networkSetup lacks authentication. The attack may be performed remotely.
Risk Assessment
An attacker can remotely manipulate network configuration without authentication, potentially leading to unauthorized changes and network security compromise.
Recommendation
Update the device firmware to the latest version. Restrict access to the management interface and monitor logs.
Other vulnerabilities in H3C NX15
See all- CVE-2026-18902High
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- CVE-2026-18901High
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-18900High
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-18814High
A vulnerability was found in H3C NX15 V100R017 affecting the function reload.reload_config in the file /api/esps. The manipulation results in command injection. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-18813High
A vulnerability has been found in H3C NX15 V100R017 affecting the function delete in the file /api/esps. Manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely, and the exploit has been disclosed to the public.
- CVE-2026-18812High
A flaw has been found in H3C NX15 V100R017 affecting the function esps.ipv6.wan in the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-18811High
A vulnerability was detected in H3C NX15 V100R017 affecting the function Add in the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-15479High
A vulnerability was found in H3C NX15 V100R017 in the administrator password change function. Manipulating the newPass argument in requests to /api/login/modify allows setting a weak password, facilitating password recovery. The attack can be launched remotely and exploit details have been made public.
Original NVD description (English source)
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.