Description
A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Published: 2026-08-04
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command injection flaw exists in the reload.reload_config function of H3C NX15 V100R017, allowing an attacker to execute arbitrary shell commands on the device. The vulnerability stems from improper validation of input supplied to the API endpoint /api/esps, and is consistent with CWE-74 and CWE-77. Successful exploitation would grant an attacker full control over the affected chassis, enabling lateral movement, data exfiltration, or service disruption.

Affected Systems

The flaw targets H3C NX15 routers running firmware V100R017. No other product versions are verified to be affected; only the listed version is confirmed.

Risk and Exploitability

The CVSS score is 8.6, indicating a high severity impact. EPSS is not available, so the precise probability of exploitation remains unclear, but a public exploit has been released. The vulnerability is not yet listed in the CISA KEV catalog, yet its accessibility via a remote API and the availability of an exploit mean that an attacker can abuse it with remote access to the management interface.

Generated by OpenCVE AI on August 4, 2026 at 22:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the NX15 unit to the latest firmware version that addresses the reload.reload_config command injection issue.
  • If an update is unavailable, restrict or disable the /api/esps reload.reload_config endpoint and enforce strong authentication or firewall rules to limit remote API access.
  • Implement network segmentation and monitoring to detect and block suspicious API calls that contain command injection patterns.

Generated by OpenCVE AI on August 4, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Title H3C NX15 esps reload.reload_config command injection
First Time appeared H3c
H3c nx15
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*
Vendors & Products H3c
H3c nx15
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

H3c Nx15
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-04T21:15:09.662Z

Reserved: 2026-08-04T12:46:18.289Z

Link: CVE-2026-18814

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')