CVE-2026-112371 in Magic NX15
Summary
by MITRE • 10/20/2026
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The H3C Magic NX15 router, specifically version V100R017, contains a critical security flaw within its Remote Procedure Call interface component that allows for remote code execution through improper input validation in the write function of the /api/esps endpoint. This vulnerability stems from a manipulation of the path argument supplied to the API handler, which fails to adequately sanitize or restrict user-supplied data before processing it. The RPC Interface serves as a mechanism for external applications and management systems to interact with the router's internal services, making this component a high-value target for attackers seeking administrative control over network infrastructure. By exploiting the lack of strict path validation, an attacker can inject malicious commands that are subsequently executed by the system with elevated privileges inherent to the service account running the RPC interface.
This specific flaw is categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The technical mechanism involves passing a crafted path string that includes shell metacharacters or sequence commands designed to break out of the intended context and execute arbitrary system-level instructions. Because the vulnerability resides within a network-accessible API endpoint, it falls squarely into MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically allowing for remote command execution without requiring prior authentication if the service is exposed or accessible via default configurations. The ability to manipulate arguments in this manner bypasses standard access controls that might otherwise limit interaction with sensitive system functions, effectively granting an unauthenticated attacker full control over the underlying operating system of the router.
The operational impact of this vulnerability is severe, as it compromises the confidentiality, integrity, and availability of the entire network segment protected by the H3C Magic NX15 device. An exploited instance allows adversaries to install persistent backdoors, pivot into internal networks, exfiltrate sensitive data traversing the gateway, or disrupt critical services through denial-of-service attacks initiated from within the system itself. Given that this exploit has been publicly disclosed and is actively utilized in the wild, organizations relying on affected firmware versions face immediate risk of compromise without timely intervention. The public availability of proof-of-concept code lowers the barrier to entry for malicious actors who may not possess advanced exploitation skills but can leverage existing tools to target vulnerable infrastructure at scale.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches that address the input validation logic within the RPC interface's write function. Administrators should verify their firmware version and apply updates released by H3C that specifically resolve this path manipulation issue if available. In cases where patching is not immediately feasible, network segmentation policies should be enforced to restrict access to the management interfaces of these routers from untrusted networks. Additionally, implementing strict firewall rules to limit exposure of API endpoints to only authorized IP addresses can reduce the attack surface significantly. Continuous monitoring for anomalous outbound connections or unusual process executions originating from router IPs is also recommended to detect potential exploitation attempts in real time and respond accordingly before significant damage occurs.