{"id":"CVE-2026-112370","kind":"vulnerability","aliases":["CVE-2026-112370"],"related":[],"title":"H3C Magic NX15 router: remote OS command injection in usrlist","description":"A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","summary":"H3C Magic NX15 firmware 100R017 (NX15V100R017): /usr/bin/usrlist function sub_416874 reads /var/run/agentlist and puts each line, unescaped, into a popen() shell command. A double quote breaks out and runs commands as root, automatically from a 1-second timer. The reporter says authentication is required to plant the data (CVSS 3.1 PR:H, 7.2); the CNA scored it 9.9 with PR:L. A public PoC exists. H3C has published no fix or advisory that we found.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Magic NX15","fixed":[],"affected":"NX15V100R017 (100R017)","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","h3c","infrastructure","magic-nx15","poc-public","routers","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Open the router admin page and read the firmware version; NX15V100R017 / 100R017 is the only version reported affected. Check whether the admin interface is reachable from WAN or untrusted LAN. Other versions: unknown.","fix":"No fixed firmware or vendor advisory found (VulDB: no countermeasures known). Until H3C publishes one: do not expose the admin/web interface to WAN, restrict it to trusted hosts, change admin credentials, and consider replacing the device.","status":"open","published_at":"2026-10-19T23:17:35+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:53+00:00","updated_at":"2026-10-23T23:24:34+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:39:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"H3C Magic NX15 router: remote OS command injection in usrlist","impact":"high","summary":"The H3C Magic NX15 100R017 router has an OS command injection flaw in the function sub_416874 of /usr/bin/usrlist. A remote attacker can run operating system commands on the device, and a public exploit exists.","category":"infrastructure","who_cares":["h3c","magic-nx15","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands as root on the router.","analyst_note":"Find the vendor advisory or firmware fix for 100R017 and confirm whether the login or web interface is required to reach usrlist.","how_to_check":"Check the firmware version on the router admin page or with the device's system info, and confirm whether it is 100R017. unknown for other checks.","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2930,"output_tokens":370,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or firmware fix for 100R017 and confirm whether the login or web interface is required to reach usrlist.","search":"'-112370':13A,16A '-2026':12A,15A '/usr/bin/usrlist':40B,128C '/var/run/agentlist':45B '1':69B '100r017':38B,117C '3.1':83B '416874':43B,124C '7.2':86B '9.9':91B 'advisori':105B 'affect':120C 'attack':141C 'authent':75B 'automat':66B 'break':59B 'cna':88B 'command':7A,20B,55B,63B,135C 'command-inject':19B 'contact':157C 'could':151C 'cve':11A,14A 'cvss':82B 'data':81B 'disclosur':161C 'doubl':57B 'earli':158C 'exist':98B 'exploit':138C,145C 'file':127C 'firmwar':37B 'fix':103B 'found':108B,112C 'function':41B,122C 'h':85B 'h3c':1A,22B,34B,99B,114C 'host':33B 'infrastructur':23B 'inject':8A,21B,136C 'issu':119C 'l':94B 'line':49B 'made':148C 'magic':2A,17A,25B,35B,115C 'magic-nx15':24B 'manipul':131C 'nx15':3A,18A,26B,36B,116C 'nx15v100r017':39B 'os':6A,134C 'perform':129C 'plant':79B 'poc':28B,97B 'poc-publ':27B 'popen':53B 'possibl':143C 'pr':84B,93B 'public':29B,96B,149C 'publish':101B 'put':47B 'quot':58B 'read':44B 'remot':5A,137C 'report':73B 'requir':77B 'result':132C 'root':65B 'router':4A,30B 'run':62B 'say':74B 'score':89B 'second':70B 'self':32B 'self-host':31B 'shell':54B 'sub':42B,123C 'timer':71B 'unescap':50B 'use':153C 'usrlist':10A 'vendor':155C 'vulner':110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T23:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112370","severity":null,"published_at":"2026-10-19T23:17:35+00:00","modified_at":"2026-10-22T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112370:433","url":null,"severity":null,"published_at":"2026-10-23T23:24:34+00:00","modified_at":"2026-10-23T23:24:34+00:00","first_seen_at":"2026-10-23T23:24:34+00:00","fetched_at":"2026-10-23T23:24:34+00:00","note":"No H3C advisory or fixed firmware found; VulDB submit #983537 (reporter) says authentication required (PR:H), runs as root, public PoC on GitHub (XxingGoD). Not exploited in the wild as far as sources show. PoC page not readable. Siblings CVE-2026-112371/112373 same device."}],"documents":[{"id":1943,"url":"https://vuldb.com/submit/983537","title":"VulDB Submit #983537: H3C Magic NX15 usrlist OS command injection (reporter's technical detail)","kind":"advisory","source":"analyst","text":"Reporter starlight: sub_416874 in /usr/bin/usrlist reads /var/run/agentlist line by line and interpolates each line unescaped into a popen() shell command; a double quote breaks out and runs commands as root. Reached from a 1-second timer callback, so it runs automatically. File written by /usr/bin/smartnet. Authentication required (reporter CVSS 3.1 PR:H, 7.2). Verified uid=0 on device. Affected: NX15V100R017.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1944,"url":"https://vuldb.com/vuln/422416","title":"VulDB VDB-422416","kind":"advisory","source":"analyst","text":"VulDB: H3C Magic NX15 100R017, remote, PoC public, no countermeasures known, vendor contacted early, no response noted.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1945,"url":"https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce","title":"XxingGoD/H3C-NX15-R017-Vulns usrlist_cmdi_root_rce (PoC)","kind":"poc","source":"analyst","text":"Public PoC repo referenced by GHSA-8prf-gf7g-jf8h and VulDB. Not fetched directly (page returned empty).","published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}