CVE-2026-112370 in Magic NX15
Summary
by MITRE • 10/20/2026
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The H3C Magic NX15 router, specifically running firmware version 100R017, contains a critical security flaw within its user management subsystem that allows for remote code execution via operating system command injection. This vulnerability resides in the binary file located at /usr/bin/usrlist and is triggered by specific manipulation of inputs processed by the function sub_416874. The presence of this flaw indicates a fundamental failure in input validation and sanitization mechanisms within the application logic, where user-supplied data is likely concatenated directly into system commands without adequate filtering or escaping. This architectural weakness enables an attacker to inject arbitrary shell commands that are executed with the privileges of the vulnerable process, which typically runs under elevated permissions on embedded network devices such as routers.
The operational impact of this vulnerability is severe due to its remote exploitability and the public availability of proof-of-concept code. Because the attack vector is remote, an adversary does not need physical access or prior authentication to leverage this flaw, provided they can reach the affected service over the network. The fact that the exploit has been made public significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and widespread exploitation in the wild. Successful exploitation could allow a remote attacker to gain full control over the router's operating system, leading to potential data exfiltration, use of the device as part of a botnet, or pivoting into internal network segments protected by this gateway. This represents a significant risk to both residential and small business networks relying on these devices for connectivity and security policy enforcement.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The root cause is the lack of proper validation of metacharacters or special symbols that have meaning to the operating system shell. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK ID T1059 Command and Scripting Interpreter, specifically allowing for direct command execution on a remote host. The ability to execute arbitrary commands effectively bypasses standard access controls if the vulnerable service is accessible without strong authentication or network segmentation protections.
Mitigation strategies should prioritize immediate patching by updating the H3C Magic NX15 firmware to the latest version released by the vendor, which likely includes fixes for this input validation issue. In environments where immediate patching is not feasible, administrators should implement strict network access control lists to restrict traffic to the affected service on port 80 or other relevant management interfaces to trusted IP addresses only. Additionally, deploying intrusion detection systems with signatures capable of detecting OS command injection payloads can provide an additional layer of defense against exploitation attempts. Long-term remediation requires a shift in development practices for embedded devices to include rigorous static and dynamic analysis focused on input handling and secure coding standards such as OWASP guidelines for preventing command injection vulnerabilities.