CVE-2026-18901
Received Received - Intake

Remote Code Execution in H3C NX15 Web API

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulDB

Description
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18901
EUVD
EUVD-2026-53030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
h3c nx15 v100r017

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code execution (RCE) flaw in H3C NX15 V100R017 devices. It exists in the service.add function of the Web API's /api/esps endpoint. An attacker can exploit this to execute arbitrary commands with root privileges by manipulating the service.add function, potentially gaining full control of the device.

Detection Guidance

Check for unauthorized service.add API calls to /api/esps in H3C NX15 V100R017. Monitor network traffic for suspicious POST requests to this endpoint. Review logs for unexpected service additions or root-level command executions.

Impact Analysis

If exploited, this vulnerability allows attackers to remotely execute arbitrary code on the device with high privileges. This could lead to complete system compromise, unauthorized access, data theft, or disruption of services. The exploit is publicly available, increasing the risk of widespread attacks.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Organizations using affected H3C devices may face legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Apply vendor patches if available. Disable or restrict access to the /api/esps endpoint. Change default credentials and enforce strong authentication. Monitor for signs of exploitation like unexpected service additions or root shells.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart