Remote Command Injection Flaw Found in H3C Magic NX15 Firmware
A critical vulnerability in H3C Magic NX15 firmware allows remote attackers to execute arbitrary OS commands via a public exploit.
Key points
- CVE-2026-112370 is rated Critical with a CVSS score of 9.4 in one record.
- The flaw resides in the /usr/bin/usrlist binary and involves OS command injection.
- Publicly available exploit code exists, and the vendor was notified early.
H3C Magic NX15 devices running firmware version 100R017 are affected by a remote vulnerability identified as CVE-2026-112370. According to the National Vulnerability Database, this flaw allows attackers to perform OS command injection remotely.
At a glance
- CVE
- CVE-2026-112370
- Product
- H3C Magic NX15
- CVSS
- 9.4 Critical
- Weakness
- OS command injection
- Exploited
- No known exploitation
The vulnerability exists within the function sub_416874 of the file /usr/bin/usrlist. Exploitation of this issue results in OS command injection, which can be performed remotely. The NVD records indicate that exploit code for this vulnerability has been made public and could be used by threat actors.
Severity and Technical Details
The National Vulnerability Database lists two severity ratings for CVE-2026-112370. One record assigns a CVSS score of 9.4, classifying the issue as Critical. Another record rates the same vulnerability at 8.6, categorizing it as High. Both records cite CWE-78 and CWE-77 as the underlying weakness classes.
The source material identifies these CWEs but does not define them. The vulnerability description states that performing a manipulation results in OS command injection. This allows remote exploitation of the attack.
Vendor Response and Disclosure
The vendor was contacted early about this disclosure. The source material does not state whether a patch or software update has been released. It only confirms that the vendor received early notification regarding the issue.
The affected product is the H3C Magic NX15. The vulnerability is present in firmware version 100R017. The source material does not specify the typical use case or environment for this device.
What should you do?
Security teams should identify any H3C Magic NX15 devices running firmware version 100R017. If these devices are present, they should be monitored for signs of exploitation. Since the exploit has been made public, the risk of use is possible.
What to do and how to stay safe: H3C
- Inventory network assets to identify H3C Magic NX15 devices running firmware version 100R017.
- Monitor affected devices for signs of unauthorized OS command injection attempts.
- Restrict remote access to the /usr/bin/usrlist service if possible.
- Wait for official vendor guidance before applying unverified patches or workarounds.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112370?
The National Vulnerability Database lists two scores: 9.4 (Critical) and 8.6 (High).
Is there a patch available for this vulnerability?
No fix has been confirmed yet; the source material only states the vendor was contacted early.
Which specific file is affected by this command injection flaw?
The vulnerability affects the function sub_416874 in the file /usr/bin/usrlist.
