Live › vulnerability › CVE-2026-112370
Go to dashboardH3C Magic NX15 firmware 100R017 (NX15V100R017): /usr/bin/usrlist function sub_416874 reads /var/run/agentlist and puts each line, unescaped, into a popen() shell command. A double quote breaks out and runs commands as root, automatically from a 1-second timer. The reporter says authentication is required to plant the data (CVSS 3.1 PR:H, 7.2); the CNA scored it 9.9 with PR:L. A public PoC exists. H3C has published no fix or advisory that we found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Magic NX15 | vendor | NX15V100R017 (100R017) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112370")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.