CVE-2026-112372: H3C Magic NX15 upload importprofile path traversal
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
H3C Magic NX15 devices running V100R017 are affected. The issue can be exploited remotely, so devices reachable by an attacker are exposed if the attacker has the required privileges.
What level of access does an attacker need?
The published severity vector indicates high privileges are required. No user interaction is required.
How urgent is remediation?
Public exploit code is available and may be used in attacks. Prioritize affected, remotely reachable devices, particularly where high-privilege accounts could be compromised.