CVE-2026-112370

CRITICAL 9.9

H3C Magic NX15 usrlist sub_416874 os command injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CWE	CWE-78 CWE-77
Vendor	h3c
Product	magic nx15
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for h3c magic nx15

Be the first to know when new critical vulnerabilities affecting h3c magic nx15 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

H3C / Magic NX15

100R017

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422416 vuldb.com: https://vuldb.com/vuln/422416/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112370 vuldb.com: https://vuldb.com/submit/983537 github.com: https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce github.com: https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce/poc

Credits

🔍 starlight (VulDB User) VulDB CNA Team