The vulnerability consists of multiple command injection flaws in the /api/esps request handler of several H3C network devices. Attacker-controlled request parameters are passed directly to shell expressions evaluated with eval, enabling the execution of arbitrary commands with root privileges. Because these parameters lack proper validation, an attacker can supply arbitrary shell commands and execute them as root, resulting in full compromise of the affected device, allowing configuration changes, persistence, or disruption of network operations.

Affected models include H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002, and H3C MC102G HM1A0V200R010. The vulnerability affects the esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, and esps.system.ntp interfaces, with certain methods unavailable on specific models.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of 2% reflects a low probability of exploitation at this time. The attack vector is likely remote network access to the exposed /api/esps endpoint, with the likely attack mode being remote API calls. Based on the description, it is inferred that authentication may not be required to reach the vulnerable API, although this is not explicitly stated in the advisory. The vulnerability is not listed in the CISA KEV catalog, but its ability to execute arbitrary commands with root privileges makes it a high priority for mitigation.