CVE-2026-18900
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, potentially leading to full compromise of the router and traffic interception.
Recommendation
Apply vendor patches immediately or restrict access to the management interface.
Other vulnerabilities in H3C NX15
See all- CVE-2026-18902High
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- CVE-2026-18901High
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-18814High
A vulnerability was found in H3C NX15 V100R017 affecting the function reload.reload_config in the file /api/esps. The manipulation results in command injection. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-18813High
A vulnerability has been found in H3C NX15 V100R017 affecting the function delete in the file /api/esps. Manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely, and the exploit has been disclosed to the public.
- CVE-2026-18812High
A flaw has been found in H3C NX15 V100R017 affecting the function esps.ipv6.wan in the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. The attack can be launched remotely, and the exploit has been published.
- CVE-2026-18811High
A vulnerability was detected in H3C NX15 V100R017 affecting the function Add in the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-18810High
A security vulnerability has been detected in H3C NX15 V100R017. An unknown function in the file /api/wizard/networkSetup lacks authentication. The attack may be performed remotely.
- CVE-2026-15479High
A vulnerability was found in H3C NX15 V100R017 in the administrator password change function. Manipulating the newPass argument in requests to /api/login/modify allows setting a weak password, facilitating password recovery. The attack can be launched remotely and exploit details have been made public.
Original NVD description (English source)
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.