Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-112371: H3C Magic NX15 allows remote code injection via RPC
CVE-2026-112371 · published 16 days ago
Summary
The RPC interface in H3C Magic NX15 can be tricked into running malicious code when a specially crafted file path is sent to its /api/esps write function. An attacker could do this from anywhere on the network without needing physical access. Apply the vendor’s security update or disable the affected RPC function until a patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| h3c | magic nx15 | NX15V100R017 |
Original advisory text
H3C Magic NX15 RPC esps write code injection
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-94Code Injection
CWE-74Injection
Timeline
Published19 Oct 2026
Updated4 Nov 2026
First seen19 Oct 2026
Track software like this
Free during beta