CVE-2026-18900 in NX15
Summary
by MITRE • 08/05/2026
A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability identified in H3C NX15 V100R017 represents a critical operating system command injection flaw within the Backend RPC component of the device's web interface. This weakness specifically affects the file.exec function located in the /api/esps endpoint, where improper input validation allows attackers to manipulate the File argument parameter. The vulnerability stems from insufficient sanitization of user-supplied data before executing system commands, creating a direct pathway for malicious command execution on the underlying operating system. The issue manifests through the backend RPC functionality that processes file operations, making it particularly dangerous as it operates at a privileged level within the device's architecture.
The technical exploitation of this vulnerability enables remote attackers to execute arbitrary operating system commands without authentication, leveraging the exposed API endpoint to inject malicious payloads into the File argument parameter. This command injection occurs because the application directly incorporates user input into system command execution contexts without proper validation or escaping mechanisms. The flaw operates at the core of the device's file handling capabilities, where legitimate file operations are processed through the backend RPC interface, providing attackers with elevated privileges to manipulate system resources. According to CWE standards, this represents a classic command injection vulnerability classified under CWE-78, which specifically addresses improper neutralization of special elements used in OS commands.
The operational impact of this vulnerability extends beyond simple remote code execution, as it provides attackers with complete control over the affected device's operating system. Remote exploitation allows threat actors to perform actions such as installing malware, modifying system configurations, accessing sensitive data, or establishing persistence mechanisms within the network infrastructure. The public availability of exploit code significantly amplifies the risk, as it removes the requirement for advanced technical skills typically needed to develop custom attack vectors. Network administrators face the challenge of defending against attacks that can originate from any external IP address with access to the device's API endpoints, potentially compromising entire network segments if multiple devices are vulnerable.
Mitigation strategies should focus on immediate patching of the affected firmware version, as well as implementing network-level restrictions to limit access to the vulnerable API endpoints. Organizations should consider disabling unnecessary API functions and implementing strict input validation at all entry points where user data is processed. Network segmentation and access control measures can help limit the potential impact if exploitation occurs. Security monitoring should include detection of unusual command execution patterns and unauthorized API access attempts. The vulnerability aligns with ATT&CK techniques for command injection and remote code execution, emphasizing the need for comprehensive defensive measures including network traffic analysis, endpoint detection, and response protocols to identify and contain potential compromises. Regular security assessments and vulnerability scanning should be implemented to identify similar weaknesses in other network infrastructure components that may present analogous attack surfaces.