| 标题 | H3C NX15 Router NX15V100R017 Command Injection |
|---|
| 描述 | H3C NX15 Router firmware NX15V100R017 contains an authenticated command injection vulnerability in the repeater configuration workflow reachable through esps.wan.repeater.set. Attacker-controlled my2P4key data is written into /tmp/config/repeater_status and later consumed by the repeaterproc runtime when the 2.4G repeater initialization path runs. In that path, the value is inserted into a shell-constructed ubus call esps.system changepasswd '{"newPass":"%s"}' command template and executed through mw_system(), allowing a remote authenticated administrator to execute arbitrary commands as root.
The issue is conditional rather than immediate. Exploitation requires the repeater state machine to enter the associated 2.4G initialization branch, and successful triggering therefore depends on repeater runtime conditions rather than a single direct API call. However, the root cause is a concrete shell command injection in product-specific backend logic, not a hypothetical candidate. Runtime validation confirmed both marker-file execution and a spawned root shell, so the issue is suitable for external submission as a confirmed conditional authenticated root RCE. |
|---|
| 来源 | ⚠️ https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc |
|---|
| 用户 | coconut (UID 98382) |
|---|
| 提交 | 2026-06-13 10時58分 (2 月前) |
|---|
| 管理 | 2026-08-04 22時05分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 385936 [H3C NX15 V100R017 /api/esps esps.wan.repeater.set/repeaterproc my2P4key 权限提升] |
|---|
| 积分 | 20 |
|---|