H3C Magic NX15 Faces Critical Remote Code Injection Vulnerability

H3C Magic NX15 devices running firmware version NX15V100R017 contain a critical security vulnerability that allows for remote code injection. According to the National Vulnerability Database, this flaw is tracked as CVE-2026-112371 and carries a CVSS score of 9.4, indicating a severe risk level.

The vulnerability resides within the RPC Interface component, specifically impacting the write function associated with the file path /api/esps. Attackers can manipulate the argument path to execute arbitrary code. Because the attack vector is remote, adversaries do not need physical access to the device to exploit this weakness.

The National Vulnerability Database lists two severity ratings for this entry. One record assigns a CVSS score of 9.4, classifying the issue as critical. Another record lists the same vulnerability with a CVSS score of 8.6, which falls into the high severity category. Both records cite CWE-94 and CWE-74 as the underlying weaknesses.

Context and Background

The exploit for CVE-2026-112371 has been publicly disclosed. This means that the method for abusing the vulnerability is available for malicious actors to utilize. The source material confirms that the vendor was contacted early regarding this disclosure, suggesting prior awareness of the security gap before public release.

The specific technical vector involves code injection through the manipulation of the path argument. This occurs within the write function of the RPC Interface. Such flaws typically allow attackers to bypass standard security controls if the input is not properly sanitized or validated by the application logic.

Who Is Affected

The vulnerability specifically impacts H3C Magic NX15 devices. The affected software version is identified as NX15V100R017. Organizations using this specific firmware release should verify their current version status immediately. No other H3C products or firmware versions are mentioned in the provided source material as being affected by this specific CVE.

The public nature of the exploit increases the likelihood of automated scanning and targeted attacks against systems running this version. Security teams should assume that any unpatched instance of NX15V100R017 is exposed to potential compromise if accessible from an untrusted network.

What should you do?

Security professionals should audit their H3C Magic NX15 deployments to identify any units running version NX15V100R017. Given the remote nature of the exploit, network segmentation and access controls should be reviewed to limit exposure. Monitor for unusual activity originating from or targeting these devices.