| शीर्षक | H3C NX15 Router NX15V100R017 Command Execution |
|---|
| विवरण | H3C NX15 Router firmware NX15V100R017 exposes the raw ubus object service through the authenticated /api/esps interface. The vulnerable design allows a remote web user with administrator credentials to call service.add, a privileged service-management RPC that registers new procd service instances and accepts an attacker-controlled command array. The web layer does not constrain this access to a safe subset of operations and therefore exposes internal service-control functionality directly to the management API.
This is a practical root execution primitive rather than a theoretical design concern. By registering a crafted service definition that uses /bin/sh -c or another attacker-controlled command vector, the caller can cause the service manager to launch arbitrary code as root. The issue stems from unsafe exposure of a dangerous backend method across the web/API trust boundary, and exploitation yields immediate root command execution without relying on fragile shell-filter bypasses in a product-specific script. |
|---|
| स्रोत | ⚠️ https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce_chain |
|---|
| उपयोगकर्ता | coconut (UID 98382) |
|---|
| सबमिशन | 13/06/2026 09:57 AM (2 महीनों पहले) |
|---|
| संयम | 04/08/2026 10:05 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385935 [H3C NX15 V100R017 Web API /api/esps service.add अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|