Description
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Published: 2026-10-19
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A stack-based buffer overflow flaw exists in the sub_416874 function of the /usr/bin/usrlist executable on H3C Magic NX15 NX15V100R017 firmware. By supplying a specially crafted input, an attacker can corrupt the call stack, potentially allowing arbitrary code execution or denial of service. The weakness is classified as CWE-119 and CWE-121.

Affected Systems

The affected product is H3C Magic NX15 running firmware version NX15V100R017. The vulnerability lies in the usrlist utility, which is part of the device's command-line interface.

Risk and Exploitability

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score is not available, so the current exploitation likelihood is uncertain, but the vulnerability is publicly disclosed and can be triggered remotely. The vulnerability is not listed in the CISA KEV catalog, but its remote exploitation potential means it should be treated with urgency. An attacker with network access to the device could invoke the vulnerable function, causing stack corruption that may lead to code execution or service disruption.

Generated by OpenCVE AI on October 20, 2026 at 06:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Identify all devices running the vulnerable firmware and isolate them from untrusted networks.
  • Apply any vendor‑released patch or firmware update that addresses the usrlist stack overflow.
  • As a short‑term workaround, disable external access to the usrlist utility or restrict access to trusted privileged accounts.
  • Monitor devices for abnormal processing or crashes that could indicate exploitation attempts.
  • Conduct penetration testing or vulnerability scanning to confirm the remediation status.

Generated by OpenCVE AI on October 20, 2026 at 06:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared H3c magic Nx15
Vendors & Products H3c magic Nx15

Mon, 19 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Title H3C Magic NX15 usrlist sub_416874 stack-based overflow
First Time appeared H3c
H3c magic Nx15 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:*
Vendors & Products H3c
H3c magic Nx15 Firmware
References
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

H3c Magic Nx15 Magic Nx15 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T13:51:59.801Z

Reserved: 2026-10-19T15:59:01.321Z

Link: CVE-2026-112373

cve-icon Vulnrichment

Updated: 2026-10-20T13:51:56.057Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T00:17:30.750

Modified: 2026-10-20T19:27:34.430

Link: CVE-2026-112373

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:30:10Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow