H3C Magic NX15 RPC Interface Code Injection CVE-2026-112371
Remote code injection in H3C Magic NX15 RPC interface exposes networks to public exploit targeting specific firmware versions.
Key points
- CVE-2026-112371 affects H3C Magic NX15 version NX15V100R017 via RPC Interface.
- Public exploit exists for this critical code injection vulnerability in /api/esps.
- No patch or fix has been confirmed by the vendor as of the disclosure.
H3C Magic NX15 devices running version NX15V100R017 face immediate risk from a remote code injection flaw. The vulnerability resides in the RPC Interface component, specifically within the write function of the /api/esps file. Attackers can manipulate the path argument to execute arbitrary code on the device.
Root cause
The National Vulnerability Database identifies the weakness as CWE-94 and CWE-74. The description states that executing a manipulation of the argument path can lead to code injection. The flaw is located in the write function of the /api/esps file within the RPC Interface component.
Attack path
Exploitation can be executed remotely against the targeted RPC Interface. An adversary manipulates the path argument to trigger the code injection. The exploit has been publicly disclosed and may be utilized by attackers. The vendor was contacted early about this disclosure.
Affected versions
- H3C Magic NX15 firmware version NX15V100R017 is affected.
- The NVD record lists this specific version string under the affected component.
- No other versions are mentioned in the provided source material.
Mitigation
- Restrict network access to the RPC Interface to trusted management subnets only.
- Implement firewall rules to block unauthorized external connections to the API endpoint.
- Monitor for unusual traffic patterns targeting the /api/esps file path.
- Isolate affected devices from critical network segments until a vendor update is released.
Detection notes
Security teams should inspect web server logs for anomalous POST requests to the API endpoint. Look for encoded characters or unexpected path lengths in the argument fields. Network flow data may reveal connections from untrusted sources to management ports. If suspicious activity is detected, immediately segment the device to prevent lateral movement while analyzing traffic captures.
What to do and how to stay safe: H3C
- Audit firewall configurations to ensure the RPC Interface is not exposed to the internet.
- Review access logs for the API component to identify potential exploitation attempts.
- Prepare to isolate devices running the affected firmware version from the main network.
- Monitor vendor communications for an official patch or mitigation advisory.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity rating for CVE-2026-112371?
The National Vulnerability Database rates this vulnerability as Critical with a CVSS score of 9.4.
Is there a patch available for H3C Magic NX15?
No fix has been confirmed yet; the vendor was contacted early about the disclosure.
Which specific component is vulnerable?
The RPC Interface component, specifically the write function in the /api/esps file.
