CVE-2026-18902 in NX15
Summary
by MITRE • 08/05/2026
A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within H3C NX15 V100R017 firmware where the esps.wan.repeater.set/repeaterproc API endpoint in the /api/esps file fails to properly sanitize user input parameters. The specific flaw occurs when processing the my2P4key argument which allows attackers to inject malicious commands that execute with elevated privileges on the affected device. This represents a critical command injection vulnerability classified as CWE-77 according to the Common Weakness Enumeration catalog, where insufficient validation of input data enables arbitrary code execution. The attack vector is remote and authenticated, meaning an attacker can exploit this issue without physical access to the device while maintaining a valid session with the system's API.
The operational impact of this vulnerability is severe as it provides attackers with complete control over the affected network appliance. Successful exploitation allows adversaries to execute arbitrary commands on the device with the same privileges as the legitimate user, potentially enabling full system compromise including data exfiltration, network reconnaissance, and establishment of persistent backdoors. This vulnerability directly maps to ATT&CK technique T1059.001 for Command and Scripting Interpreter, as it enables remote command execution through API endpoints. The public availability of exploits increases the risk significantly, making this vulnerability particularly dangerous in environments where network appliances are exposed to untrusted networks or where default credentials remain unchanged.
Mitigation strategies should include immediate firmware updates from H3C to address the identified vulnerability, implementation of network segmentation to limit access to the affected API endpoints, and enforcement of strict input validation controls on all external interfaces. Organizations should also consider disabling unnecessary API functions when not required for operations, implementing web application firewalls to monitor and filter malicious requests, and establishing robust access controls with strong authentication mechanisms. Additionally, continuous monitoring of network traffic for suspicious API calls and regular security assessments of network infrastructure will help detect potential exploitation attempts and maintain overall system integrity. The vulnerability demonstrates the importance of proper input sanitization in web applications and highlights the critical need for vendors to promptly address security issues through timely patch releases and coordinated disclosure processes.