CVE-2026-112371

CRITICAL 9.9

H3C Magic NX15 RPC esps write code injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CWE	CWE-94 CWE-74
Vendor	h3c
Product	magic nx15
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for h3c magic nx15

Be the first to know when new critical vulnerabilities affecting h3c magic nx15 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

H3C / Magic NX15

NX15V100R017

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422417 vuldb.com: https://vuldb.com/vuln/422417/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112371 vuldb.com: https://vuldb.com/submit/983538 github.com: https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/file_write_root_rce

Credits

🔍 starlight (VulDB User) VulDB CNA Team