H3C Magic NX15 vulnerabilities

A weakness has been identified in H3C Magic NX15 V100R017 affecting the importprofile function in the /api/upload file. Manipulation of the fileName argument causes path traversal, the attack can be initiated remotely, and the exploit has been made publicly available.

In H3C Magic NX15 NX15V100R017, the write function of /api/esps in the RPC Interface allows manipulation of the path argument to lead to code injection. The attack can be executed remotely, and the exploit has been publicly disclosed.

In H3C Magic NX15 100R017, the function sub_416874 in /usr/bin/usrlist allows OS command injection. Remote exploitation is possible, and the exploit has been made public.