CVE-2026-112372

Received Received - Intake

Path Traversal in H3C Magic NX15 Firmware

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112372

EUVD

EUVD-2026-104664

Affected Vendors & Products

Vendor	Product	Version / Range
H3C	Magic	NX15 V100R017

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal weakness in H3C Magic NX15 V100R017. It exists in the importprofile function of the /api/upload file. An attacker can manipulate the fileName argument to perform path traversal, potentially accessing unauthorized files or directories. The exploit is publicly available and can be used remotely.

Impact Analysis

This vulnerability allows remote attackers to traverse directories and access sensitive files on the affected system. It could lead to unauthorized data access, modification, or deletion. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using the affected H3C Magic NX15 may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update or patch the H3C Magic NX15 V100R017 software to the latest version. Disable or restrict access to the /api/upload endpoint if not required. Monitor network traffic for unusual file upload activities or path traversal attempts.

Hi! I’m here to help you understand CVE-2026-112372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70