| Titolo | H3C Magic NX15 NX15V100R017 Code Execution |
|---|
| Descrizione | A vulnerability was found in H3C Magic NX15 NX15V100R017. The affected element is the function write of the file /api/esps. The manipulation of the argument path with the input /usr/libexec/rpcd/esps.system.led leads to an unrestricted file write as root, which results in command execution. It is possible to initiate the attack remotely. An authentication is required to exploit this vulnerability. The exploit has been disclosed to the public and may be used.
Technical detail:
The file.write method of the /api/esps RPC interface accepts an arbitrary absolute path and performs no normalisation, directory restriction or allow-list; it executes inside rpcd as root. lighttpd does not drop privileges because server.username and server.groupname are commented out in lighttpd.conf, and /www/api is spawned by lighttpd with root rights. The files under /usr/libexec/rpcd/ are 0755 shell scripts that rpcd executes on behalf of the corresponding ubus objects. Because fopen(path, "w") preserves the mode of an existing file, an overwritten plugin remains executable and is run with root privileges the next time the object is invoked. Verified on the device: after overwriting the plugin behind esps.system.led and invoking that object, the injected command returned uid=0(root), while the RPC reply stayed normal because the payload delegated to the read-only /rom copy of the original script. The same method reads /etc/shadow (mode 0600, owner root) successfully. This is a different code path from CVE-2026-18900, which covers the separate file.exec method.
CWE: CWE-73 (External Control of File Name or Path), CWE-94 (Improper Control of Generation of Code).
CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). |
|---|
| Fonte | ⚠️ https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/file_write_root_rce |
|---|
| Utente | starlight (UID 101288) |
|---|
| Sottomissione | 16/09/2026 09:47 (1 mese fa) |
|---|
| Moderazione | 19/10/2026 17:58 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422417 [H3C Magic NX15 NX15V100R017 RPC Interface /api/esps write path escalationi di privilegi] |
|---|
| Punti | 20 |
|---|