| Title | H3C NX15 Router NX15V100R017 Command Injection |
|---|
| Description | H3C NX15 Router firmware NX15V100R017 exposes the raw ubus object reload to authenticated web users through the generic /api/esps forwarding interface. The method reload.reload_config accepts a user-controlled config argument and constructs the shell command /sbin/config_reload %s with that value before executing it via system(). No strict allowlist, escaping, or shell-safe argument handling is applied to the config parameter before the command is executed.
This design turns a backend maintenance helper into a direct command-injection sink. A remote authenticated administrator can send a crafted /api/esps request that invokes the raw reload object and injects shell syntax into config, causing arbitrary commands to run as root. The issue is particularly strong for external reporting because the injection point is direct and does not rely on configuration poisoning or delayed execution. The web interface simply exposes a privileged method that builds a shell command from attacker-controlled input. |
|---|
| Source | ⚠️ https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce |
|---|
| User | coconut (UID 98382) |
|---|
| Submission | 06/13/2026 09:23 (2 months ago) |
|---|
| Moderation | 08/04/2026 14:46 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 385813 [H3C NX15 V100R017 /api/esps reload.reload_config command injection] |
|---|
| Points | 20 |
|---|