CVE-2026-112371: H3C Magic NX15 RPC esps write code injection
Published Oct 19, 2026
·Updated
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Affected Software
1 affected component
H3C Magic NX15=NX15V100R017
Event History
Oct 19, 2026
CVE Published
via MITRE·10:30 PM
Data Sourced
via MITRE·10:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack is remote, requires low privileges, and does not require user interaction. Exploitation involves manipulating the path argument supplied to the RPC interface's /api/esps write function.
2
Which product version is identified as affected?
The reported affected version is H3C Magic NX15 NX15V100R017.
3
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.