CVE-2026-18901 in NX15
Summary
by MITRE • 08/05/2026
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The security vulnerability identified in H3C NX15 V100R017 represents a critical remote code execution risk within the Web API component, specifically affecting the service.add function located in the /api/esps file. This flaw constitutes a dangerous routine exposure that fundamentally compromises the system's security posture by allowing unauthorized remote access to potentially harmful operations. The vulnerability exists within the web application programming interface of the network equipment, making it accessible through standard network protocols without requiring physical access or elevated privileges.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the Web API service.add function. When processing requests through the /api/esps endpoint, the system fails to properly validate or sanitize user-supplied parameters, creating an injection vector that attackers can exploit to execute arbitrary code on the target system. This weakness aligns with common software security flaws categorized under CWE-74 and CWE-94, which address injection attacks and code execution vulnerabilities respectively. The vulnerability's remote exploitability means that malicious actors can leverage this flaw from outside the network perimeter, eliminating the need for insider knowledge or physical presence.
The operational impact of this vulnerability extends beyond simple data theft or system compromise, as it provides attackers with potentially full administrative control over affected H3C NX15 devices. Remote code execution capabilities enable threat actors to install backdoors, modify system configurations, access sensitive network data, and potentially use compromised devices as launch points for lateral movement within the network infrastructure. This vulnerability directly maps to ATT&CK technique T1059.007 for command and scripting interpreter, while also supporting T1046 for network service scanning and T1566 for credential access through social engineering attacks that could leverage the compromised device.
Mitigation strategies should prioritize immediate vendor patch deployment as the primary defense mechanism against this vulnerability. Network administrators must implement strict firewall rules to restrict access to the affected Web API endpoints, particularly blocking external access to port 80 and 443 if possible. Additional protective measures include implementing network segmentation to isolate critical infrastructure, deploying intrusion detection systems to monitor for suspicious API activity, and conducting comprehensive network scans to identify potentially compromised devices. The vulnerability's public disclosure status necessitates urgent action since threat actors may already be actively exploiting this weakness in the wild, making it critical for organizations to assess their exposure and implement compensating controls immediately.