Description
A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-08-04
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote attacker can craft a malicious value for the esps.apcm.version parameter in the delete API, leading to command injection that allows execution of arbitrary commands on the affected device. The flaw directly impacts the confidentiality, integrity, and availability of the device because it grants the attacker full control over the operating system.

Affected Systems

The flaw exists in H3C NX15 running firmware V100R017. Any instance of this device that exposes the /api/esps delete endpoint is susceptible, and only this version has been documented as vulnerable; earlier or later firmware releases are not known to be affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.6, indicating high severity. Although an EPSS value is not available, the public disclosure means it may be actively exploited. The flaw is not yet listed in CISA’s KEV catalog, but the ability to execute commands remotely gives an attacker full device takeover with no mitigations in place.

Generated by OpenCVE AI on August 4, 2026 at 22:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the vendor’s firmware update that fixes the command injection flaw.
  • If a patch is not yet available, isolate the device by restricting external network access to the /api/esps endpoint using firewall or access control lists.
  • Implement strict input validation or filtering on the esps.apcm.version parameter to prevent injection of shell commands.
  • Monitor device logs for unexpected delete requests or command execution anomalies.

Generated by OpenCVE AI on August 4, 2026 at 22:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Title H3C NX15 esps delete command injection
First Time appeared H3c
H3c nx15
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*
Vendors & Products H3c
H3c nx15
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

H3c Nx15
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T21:00:09.457Z

Reserved: 2026-08-04T12:46:14.664Z

Link: CVE-2026-18813

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')