H3C Magic NX15 CVE-2026-112371

Exploitation requires network access to the router's RPC management interface and invocation of the write function at /api/esps with a manipulated path argument to inject code (CWE-94). The CVSS vector's PR:L indicates low-privilege authentication to the device is required, which is the primary limiting factor - this is not an unauthenticated exploit against a default configuration. Realistic exposure further depends on whether the management/RPC interface is reachable from the attacker's network position (e.g., LAN-side only versus WAN-exposed management); WAN exposure is not stated and should be verified. No user interaction is required (UI:N), and attack complexity is low (AC:L).

This is a CWE-94 code injection flaw in the RPC interface (/api/esps write function, path argument) of the H3C Magic NX15 home router, scored 8.6 via a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact plus high subsequent-system impact. The signals partially conflict and must be read carefully. Exploitation maturity in the vector is E:P (proof-of-concept), consistent with a publicly available GitHub exploit - so publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS score was provided, meaning there is no evidence of active, widespread exploitation at time of analysis. The PR:L metric indicates the attack is network-reachable but requires some level of authentication/privilege, which meaningfully lowers real-world risk versus a fully unauthenticated RCE. Crucially, the entire record originates from a single source (VulDB), with no independent vendor advisory, so the CVSS metrics are likely auto-generated and should be treated as unverified. Net assessment: a genuinely serious device-takeover bug where exploit code is public, but the authentication requirement and single-source, vendor-unconfirmed provenance make this a monitor-and-patch priority rather than an emergency on par with a KEV-listed unauthenticated RCE - verify authentication prerequisites with the vendor.

An attacker with network reachability to the router's management RPC interface and the low-level privileges required by the vector sends a crafted request to the /api/esps write endpoint, injecting malicious content via the path argument to achieve code execution on the device. A proof-of-concept exploit is publicly available on GitHub (XxingGoD/H3C-NX15-R017-Vulns), lowering the skill barrier. Because AC:L indicates low attack complexity, a successful request yields reliable code execution, likely as root, giving full control of the router.