| शीर्षक | H3C NX15 Router NX15V100R017 Command Injection |
|---|
| विवरण | H3C NX15 Router firmware NX15V100R017 contains an authenticated command injection vulnerability in the /api/esps RPC object esps.apcm.version, method delete. The vulnerable implementation applies only a limited blacklist to the version string supplied in list[] before passing the value into an eval assignment. Although some characters such as quotes and semicolons are filtered, the blacklist does not neutralize shell command substitution syntax and related constructs, leaving the input still dangerous when evaluated by the shell.
Because the bug exists in the backend RPC processing path, it can be triggered remotely through the authenticated web interface by any attacker who holds an administrator session. The resulting behavior is not a benign parsing error: the malformed version value is interpreted as shell content inside a root-privileged handler. This allows a remote authenticated administrator to execute arbitrary system commands and obtain full control over the router operating environment. |
|---|
| स्रोत | ⚠️ https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps_apcm_version_delete_root_rce |
|---|
| उपयोगकर्ता | coconut (UID 98382) |
|---|
| सबमिशन | 13/06/2026 09:21 AM (2 महीनों पहले) |
|---|
| संयम | 04/08/2026 02:46 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385812 [H3C NX15 V100R017 /api/esps delete esps.apcm.version अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|