| Titel | H3C NX15 Router NX15V100R017 Command Injection |
|---|
| Beschreibung | H3C NX15 Router firmware NX15V100R017 contains an authenticated command injection vulnerability in the /api/esps RPC object esps.apcm.version, method delete. The vulnerable implementation applies only a limited blacklist to the version string supplied in list[] before passing the value into an eval assignment. Although some characters such as quotes and semicolons are filtered, the blacklist does not neutralize shell command substitution syntax and related constructs, leaving the input still dangerous when evaluated by the shell.
Because the bug exists in the backend RPC processing path, it can be triggered remotely through the authenticated web interface by any attacker who holds an administrator session. The resulting behavior is not a benign parsing error: the malformed version value is interpreted as shell content inside a root-privileged handler. This allows a remote authenticated administrator to execute arbitrary system commands and obtain full control over the router operating environment. |
|---|
| Quelle | ⚠️ https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps_apcm_version_delete_root_rce |
|---|
| Benutzer | coconut (UID 98382) |
|---|
| Einreichung | 13.06.2026 09:21 (vor 2 Monaten) |
|---|
| Moderieren | 04.08.2026 14:46 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 385812 [H3C NX15 V100R017 /api/esps delete esps.apcm.version erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|