Live › vulnerability › CVE-2026-112371
Go to dashboardH3C Magic NX15 firmware NX15V100R017: the write function of the /api/esps RPC interface passes the path argument into code, giving remote code injection (CWE-94). Needs low privileges per CVSS (PR:L). A public PoC exists; no vendor fix or mitigation is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| H3C Magic NX15 | vendor | NX15V100R017 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112371")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.