The vulnerability is present in the sub_416874 function of the usrlist binary on H3C Magic NX15 firmware 100R017. By manipulating this function, an attacker can inject arbitrary operating‑system commands, resulting in remote code execution with system privileges. This flaw is critical because it allows full control over the device without needing additional privileges.

H3C Magic NX15 routers running firmware 100R017 are affected. The vendor product name is Magic NX15, and the flaw is documented as part of that firmware revision.

With a CVSS score of 9.4 the flaw is classified as critical. The EPSS score is not available, but a publicly available exploit demonstrates that the vulnerability is likely to be targeted in the wild. The flaw is not listed in the CISA KEV catalog. Attackers can reach the vulnerable function remotely through the usrlist service, and with successful exploitation gain total control of the device.