Description
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.
Published: 2026-08-04
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the file /api/wizard/networkSetup for H3C NX15 V100R017. A manipulated request can bypass authentication, allowing an attacker to access the network setup functionality without valid credentials. This flaw can result in unrestricted changes to network configuration, leading to potential disruption, data leakage or further lateral movement within the network.

Affected Systems

Affected devices are H3C NX15 routers running firmware version V100R017. The issue originates from the /api/wizard/networkSetup endpoint and is documented under the H3C NX15 product line.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, and the EPSS score is currently unavailable, implying no publicly documented exploits at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through the exposed API, especially if network segmentation or access controls are weak.

Generated by OpenCVE AI on August 4, 2026 at 21:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch or firmware upgrade for H3C NX15 that addresses the missing authentication issue.
  • Restrict external access to the management interface by firewall rules or VLAN segmentation, ensuring only trusted IP ranges can reach the /api/wizard endpoint.
  • If an update is not yet available, disable or remove the /api/wizard/networkSetup API endpoint from the device configuration, or enforce strong authentication mechanisms such as mutual TLS or enterprise single sign‑on for all management functions.

Generated by OpenCVE AI on August 4, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.
Title H3C NX15 networkSetup missing authentication
First Time appeared H3c
H3c nx15
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*
Vendors & Products H3c
H3c nx15
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

H3c Nx15
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T20:00:09.017Z

Reserved: 2026-08-04T12:46:00.744Z

Link: CVE-2026-18810

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:00:07Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function