The vulnerability is an OS command injection flaw located in the sub_416874 function of the usrlist binary on H3C Magic NX15 firmware 100R017. An attacker who can influence the input to this function can inject and execute arbitrary operating‑system commands with system privileges, resulting in full remote code execution on the device. This flaw directly corresponds to CWE‑77 (Command Injection) and CWE‑78 (OS Command Injection).

H3C Magic NX15 routers that run the 100R017 firmware revision are affected. The product vendor is H3C, and the flaw resides in the firmware that ships with the routers. No other versions or variants were mentioned in the CVE data. Devices running earlier or later firmware revisions should be verified for the presence of the flaw.

The CVSS score is 9.4, classifying the vulnerability as critical. The EPSS score of 2% indicates a moderate likelihood that attackers may exploit the flaw. The flaw is not listed in the CISA KEV catalog. Remote exploitation is possible, as the CVE notes “remote exploitation of the attack is possible”, and the exploit has been made publicly available. The attack vector is presumably through the usrlist service, though the exact method is not explicitly detailed in the CVE description and is therefore inferred. Successful exploitation would allow an attacker to take full control of the device.