H3C Magic NX15 Remote Code Injection Flaw Exposes Networks to Public Exploit
A critical remote code injection vulnerability in H3C Magic NX15 firmware allows arbitrary code execution. The exploit code is publicly available and may be utilized by attackers.
Key points
- H3C Magic NX15 version NX15V100R017 is affected by CVE-2026-112371
- The flaw allows remote code injection via the RPC Interface
- Exploit code has been publicly disclosed and may be utilized
H3C Magic NX15 devices running firmware version NX15V100R017 are vulnerable to a critical remote code injection flaw. According to the National Vulnerability Database, this issue affects the write function within the /api/esps file of the RPC Interface component. Manipulation of the path argument can lead to code injection. The vendor was contacted early regarding this disclosure, but no patch status is confirmed in the source material.
How it unfolded
- The vulnerability was identified in H3C Magic NX15 firmware version NX15V100R017
- The flaw exists in the RPC Interface component's write function
- The exploit code has been publicly disclosed and may be utilized
Who is affected
The issue impacts H3C Magic NX15 devices operating on version NX15V100R017. The NVD record assigns a CVSS score of 9.4, rating it as critical. The weaknesses are categorized as CWE-94 and CWE-74. The attack can be executed remotely, meaning an attacker does not need physical access to the device. This version is the specific release cited in the disclosure.
Our take on the response
The public disclosure of the exploit code raises the immediate risk level for affected installations. The fact that the vendor was contacted early suggests awareness, but the absence of a confirmed fix leaves users exposed. That suggests organizations relying on this firmware version must prioritize containment measures until a vendor update is verified and deployed.
Who needs to act first
Managed service providers should immediately identify all H3C Magic NX15 devices running the vulnerable firmware version. Prioritize systems exposed to untrusted networks or the internet. Isolate these devices if possible until a mitigation strategy is in place. Check network logs for unusual activity targeting the RPC interface. Coordinate with the vendor for updates. Ensure configuration backups are current before any changes. Monitor for signs of compromise.
What to do and how to stay safe: H3C
- Identify and inventory all H3C Magic NX15 devices running version NX15V100R017
- Restrict network access to the RPC Interface if configuration allows
- Monitor logs for unauthorized attempts to manipulate the path argument
- Await vendor confirmation of a patch before applying unofficial fixes
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which H3C product is affected by CVE-2026-112371?
The H3C Magic NX15 device running firmware version NX15V100R017 is affected.
Is the exploit for this vulnerability publicly available?
Yes, the exploit has been publicly disclosed and may be utilized.
What is the CVSS score for this vulnerability?
The NVD record lists a CVSS score of 9.4, rated as critical.
