---
id: "CVE-2026-112370"
kind: "vulnerability"
aliases: ["CVE-2026-112370"]
title: "H3C Magic NX15 router: remote OS command injection in usrlist"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Magic NX15", "fixed": [], "affected": "NX15V100R017 (100R017)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "h3c", "infrastructure", "magic-nx15", "poc-public", "routers", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T23:17:35+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T23:24:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112370", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:24:34+00:00"}]
---

# H3C Magic NX15 router: remote OS command injection in usrlist

H3C Magic NX15 firmware 100R017 (NX15V100R017): /usr/bin/usrlist function sub_416874 reads /var/run/agentlist and puts each line, unescaped, into a popen() shell command. A double quote breaks out and runs commands as root, automatically from a 1-second timer. The reporter says authentication is required to plant the data (CVSS 3.1 PR:H, 7.2); the CNA scored it 9.9 with PR:L. A public PoC exists. H3C has published no fix or advisory that we found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Magic NX15 affected NX15V100R017 (100R017) fixed ?

## How to check

Open the router admin page and read the firmware version; NX15V100R017 / 100R017 is the only version reported affected. Check whether the admin interface is reachable from WAN or untrusted LAN. Other versions: unknown.

## Fix

No fixed firmware or vendor advisory found (VulDB: no countermeasures known). Until H3C publishes one: do not expose the admin/web interface to WAN, restrict it to trusted hosts, change admin credentials, and consider replacing the device.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112370
- 2026-10-23T23:24:34+00:00 analyst — No H3C advisory or fixed firmware found; VulDB submit #983537 (reporter) says authentication required (PR:H), runs as root, public PoC on GitHub (XxingGoD). Not exploited in the wild as far as sources show. PoC page not readable. Siblings CVE-2026-112371/112373 same device.

## Documents

- [advisory] VulDB Submit #983537: H3C Magic NX15 usrlist OS command injection (reporter's technical detail) https://vuldb.com/submit/983537
- [describes] VulDB VDB-422416 https://vuldb.com/vuln/422416
- [poc] XxingGoD/H3C-NX15-R017-Vulns usrlist_cmdi_root_rce (PoC) https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce

## From the sources

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_