Key points
- CVE-2026-112371 affects H3C Magic NX15 version NX15V100R017.
- The vulnerability carries a CVSS score of 9.4, classified as critical.
- Publicly disclosed exploit methods may already be in use by attackers.
H3C Magic NX15 firmware version NX15V100R017 contains a critical security flaw designated as CVE-2026-112371. The vulnerability exists within the RPC Interface component, specifically in the write function of the /api/esps file. Security researchers have assigned the issue a CVSS score of 9.4, indicating a severe risk level. The weakness allows for remote code injection through the manipulation of the path argument.
In plain English
Attackers can send specially crafted requests to the RPC Interface without needing physical access to the device. By altering the path argument within these requests, they can inject and execute unauthorized code. This flaw stems from improper neutralization of special elements, categorized under CWE-94 and CWE-74. The remote nature of the attack means it can be exploited over a network.
The background
The National Vulnerability Database records this issue with a critical severity rating. Although one record lists a high score of 8.6, the primary assessment remains at 9.4. The exploit for this vulnerability has been publicly disclosed. Sources indicate that the malicious code or methods required to trigger the flaw are available. This public availability increases the likelihood of automated scanning and exploitation attempts.
What changes now
Security teams must verify if their environments run H3C Magic NX15 version NX15V100R017. The vendor was contacted early regarding this disclosure. However, the source material does not confirm the release of a patch or firmware update. Organizations should monitor vendor communications closely for official remediation guidance. Until a fix is provided, the risk remains active.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks. Check whether your H3C devices are reachable from the internet or guest networks. Isolate affected units if possible until a vendor update arrives. Limit access to the RPC Interface using strict firewall rules. Monitor logs for unusual activity related to path argument manipulation. Back up configurations before making any network changes to ensure recovery options remain available during this period.
What to do and how to stay safe: H3C
- Verify if H3C Magic NX15 version NX15V100R017 is deployed in your environment.
- Restrict network access to the RPC Interface to trusted management IPs only.
- Monitor traffic logs for anomalies related to the /api/esps endpoint.
- Watch for official vendor announcements regarding patches for CVE-2026-112371.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific version of H3C Magic NX15 is affected?
Only H3C Magic NX15 firmware version NX15V100R017 is listed as affected by this vulnerability.
Is there a patch available for CVE-2026-112371?
The source material does not confirm the availability of a patch or update.
How is the vulnerability exploited?
Attackers exploit it by manipulating the path argument in the RPC Interface write function.
