The H3C Magic NX15 firmware version V100R017 contains a weakness in the importprofile API endpoint. By manipulating the fileName argument, an attacker can traverse directories and write arbitrary files to the device. The ability to cause an arbitrary file write can affect the confidentiality, integrity, and availability of the system, potentially allowing deployment of malicious firmware or configuration changes. This weakness is categorized as input validation failure (CWE-22).

The vulnerability is present in H3C Magic NX15 routers running firmware V100R017. The exposed endpoint is /api/upload importprofile, which can be accessed remotely over the network.

The CVSS score of 5.1 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely by sending crafted HTTP requests to the importprofile endpoint. Publicly available exploit code demonstrates that an attacker can overwrite critical system files or inject malicious content. While the CVSS score does not indicate high severity, the remote execution pathway and potential for arbitrary file write give this flaw a meaningful risk assessment that warrants prompt attention.