H3C Magic NX15 CVE-2026-112370

Exploitation requires network reachability to the device's management surface AND a low-privilege authenticated session (CVSS PR:L) - it is not anonymous/unauthenticated. The specific trigger is attacker-controlled input reaching the sub_416874 function in the /usr/bin/usrlist binary, which passes data to an OS shell without sanitization, so the prerequisite is access to whatever interface invokes usrlist (device user/management functionality). Limiting factors: the required authentication foothold, exposure of the management interface (default deployment typically restricts it to the LAN side, so WAN-side exploitation depends on remote management being enabled), and the attack being confined to this specific firmware build (Magic NX15 100R017).

This is a genuine, actionable priority for anyone running the affected hardware, though not a mass-internet emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing no user interaction but requiring low-level privileges (PR:L), and all vulnerable-system impacts are High (VC:H/VI:H/VA:H) - consistent with OS command injection (CWE-78) yielding root-level RCE as the public PoC path name ('usrlist_cmdi_root_rce') indicates. Exploit maturity in the vector is E:P (Proof-of-Concept), aligning with the publicly available exploit from VulDB submitter XxingGoD. There is NO CISA KEV listing and NO EPSS score in the provided data, so active in-the-wild exploitation is NOT confirmed - the signals point to 'exploit code exists' rather than 'widespread automated exploitation.' Note a modest tension: the vendor-supplied 4.0 vector sets SC:H/SI:H/SA:H (subsequent-system impact), but a command-injection-to-root on the device itself is best modeled as vulnerable-system impact only; this inflates the chained portion of the score and should be verified. The PR:L requirement is the key risk-limiter - an attacker needs some authenticated foothold on the device (typically web-management access) rather than purely anonymous reach.

An attacker with low-privilege authenticated access to the H3C Magic NX15 management interface (e.g., a logged-in LAN/web user, or credentials obtained via default/weak passwords) sends crafted input to the usrlist handler that reaches the vulnerable sub_416874 function. Because input is passed unsanitized to an OS shell, the attacker injects commands that execute as root, fully compromising the router. A public proof-of-concept for this exact path exists on GitHub, lowering the skill barrier to reproduce the attack.