CVE-2026-112373 in Magic NX15
Summary
by MITRE • 10/20/2026
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The H3C Magic NX15 router, specifically version V100R017, contains a critical security flaw within its firmware that exposes network infrastructure to remote exploitation. This vulnerability resides in the binary file located at /usr/bin/usrlist and affects the internal function identified as sub_416874. The device is designed to manage user lists or similar administrative data structures, and the specific routine responsible for processing this input fails to perform adequate bounds checking on incoming parameters. As a result, when an attacker supplies crafted data exceeding the allocated stack memory size, it overwrites adjacent memory locations on the call stack. This condition constitutes a classic stack-based buffer overflow, which is categorized under CWE-121 in the Common Weakness Enumeration standard. The lack of proper input validation allows malicious actors to corrupt the execution flow of the application by overwriting critical return addresses or function pointers stored on the stack.
The operational impact of this vulnerability is severe due to its remote exploitability and the privileged nature of many router management interfaces. Because the flaw can be triggered remotely, an attacker does not need physical access or prior authentication credentials if the affected service is exposed to untrusted networks such as the internet. By carefully crafting a payload that exploits the stack-based buffer overflow, it is possible to achieve arbitrary code execution on the target device. This typically involves injecting shellcode into the overwritten memory space and redirecting program control flow to execute this malicious instructions. Successful exploitation grants the attacker full control over the router's operating system, effectively compromising the integrity of the network perimeter. The public disclosure of an exploit for this vulnerability significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and widespread compromise across devices running the affected firmware version.
From a tactical perspective, this vulnerability aligns with several techniques in the MITRE ATT&CK framework. The initial access phase is facilitated by Remote Code Execution (T1203), while the exploitation method itself falls under Exploitation for Privilege Escalation or Defense Evasion depending on how the attacker utilizes the compromised router. Once inside, an adversary might leverage the device as a pivot point to launch further attacks against internal network segments, effectively turning the router into a command and control server or a proxy for malicious traffic. The public availability of exploit code means that automated botnets are likely already targeting this specific weakness in real-time, making immediate remediation urgent.
Mitigation strategies must focus on both technical fixes and operational hardening. The primary defense is to apply the vendor's official firmware update as soon as it becomes available, which should include patches for the sub_416874 function to enforce strict buffer size limits and implement stack canaries or other memory protection mechanisms. In scenarios where immediate patching is not feasible due to operational constraints, network-level controls such as firewall rules restricting access to the management interface from untrusted networks are essential. Additionally, disabling unnecessary services on the router reduces the attack surface. Security teams should monitor for indicators of compromise associated with known exploits targeting this specific H3C vulnerability and ensure that intrusion detection systems are updated with signatures capable of detecting buffer overflow attempts directed at the usrlist binary.