CVE-2026-112371

Received Received - Intake

Code Injection in H3C Magic NX15 via RPC Interface

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112371

EUVD

EUVD-2026-104663

Affected Vendors & Products

Vendor	Product	Version / Range
H3C	Magic	NX15 NX15V100R017

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in H3C Magic NX15 NX15V100R017. It exists in the RPC Interface component, specifically in the write function of the file /api/esps. An attacker can manipulate the 'path' argument to inject malicious code, which can be executed remotely. The vendor was informed about the disclosure.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on the affected system. This could lead to unauthorized access, data theft, system compromise, or disruption of services. The high CVSS scores indicate a severe risk of impact.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using this product may face legal penalties, reputational damage, and loss of customer trust.

Mitigation Strategies

Immediately update the H3C Magic NX15 device to the latest firmware version provided by the vendor to address the code injection vulnerability in the RPC Interface component.

Hi! I’m here to help you understand CVE-2026-112371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70