CVE-2026-18812
HighCVSS 7.2Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
A flaw has been found in H3C NX15 V100R017 affecting the function esps.ipv6.wan in the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to full compromise of the device and the network.
Recommendation
Apply vendor patches immediately or restrict access to the /api/esps interface. Check for firmware updates.
Other vulnerabilities in H3C NX15
See all- CVE-2026-18902High
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- CVE-2026-18901High
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-18900High
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-18814High
A vulnerability was found in H3C NX15 V100R017 affecting the function reload.reload_config in the file /api/esps. The manipulation results in command injection. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-18813High
A vulnerability has been found in H3C NX15 V100R017 affecting the function delete in the file /api/esps. Manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely, and the exploit has been disclosed to the public.
- CVE-2026-18811High
A vulnerability was detected in H3C NX15 V100R017 affecting the function Add in the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-18810High
A security vulnerability has been detected in H3C NX15 V100R017. An unknown function in the file /api/wizard/networkSetup lacks authentication. The attack may be performed remotely.
- CVE-2026-15479High
A vulnerability was found in H3C NX15 V100R017 in the administrator password change function. Manipulating the newPass argument in requests to /api/login/modify allows setting a weak password, facilitating password recovery. The attack can be launched remotely and exploit details have been made public.
Original NVD description (English source)
A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.