Live › vulnerability › CVE-2026-112372
Go to dashboardThe H3C Magic NX15 V100R017 web upload endpoint /api/upload, in the importprofile function, does not sanitize the fileName argument, so path traversal sequences can write files outside the intended directory. A remote attacker can trigger it and a public exploit is available, which could let them place files on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of H3C Magic NX15 devices running firmware in the V100R017 line are exposed if the web management interface is reachable. Teams that do not run this appliance can skip it. The sources do not say whether authentication is required or which firmware build is fixed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112372")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.