| Titolo | H3C Magic NX15 NX15V100R017 OS Command Injection |
|---|
| Descrizione | A vulnerability was found in H3C Magic NX15 NX15V100R017. The affected element is the function sub_416874 of the file /usr/bin/usrlist. The manipulation of the file /var/run/agentlist leads to command injection. The command is executed with root privileges. It is possible to initiate the attack remotely. An authentication is required to exploit this vulnerability. The exploit has been disclosed to the public and may be used.
Technical detail:
sub_416874 reads /var/run/agentlist line by line and interpolates each line, without escaping, into a shell command built with the format string "cat %s | grep -E \"%s\" | awk '{print $3}'" (offset 0x41ED98) before calling popen() (0x416D2C). Because the untrusted value is placed inside a pair of double quotes, a double-quote character in a line terminates the quoting and allows arbitrary shell commands to be appended; the command runs as root. The function is reached from a 1-second timer callback (sub_4188E0 -> sub_4170E0), so execution is automatic and repeats without further interaction. The file is written by /usr/bin/smartnet; neither write site validates length or character set. Verified on the device: the injected command reported uid=0(root) and its parent process identified itself as usrlist.
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). |
|---|
| Fonte | ⚠️ https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce |
|---|
| Utente | starlight (UID 101288) |
|---|
| Sottomissione | 16/09/2026 09:46 (1 mese fa) |
|---|
| Moderazione | 19/10/2026 17:58 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422416 [H3C Magic NX15 100R017 /usr/bin/usrlist sub_416874 escalationi di privilegi] |
|---|
| Punti | 20 |
|---|