H3C Magic NX15 CVE-2026-112372

Exploitation requires the attacker to invoke the importprofile function of /api/upload and inject directory-traversal sequences into the fileName argument on an H3C Magic NX15 (V100R017) device. The critical limiting factor is PR:H: per the CVSS vector the attacker must already possess high/administrative privileges on the router's management interface, so this is a post-authentication flaw rather than an unauthenticated remote compromise. No user interaction is needed (UI:N) and it is network-reachable (AV:N), but practical exploitation depends on prior access to or compromise of privileged router credentials.

This is a low-priority issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with all impact metrics set to Low yields a base score of only 2.0, and the key limiting factor is PR:H - the attacker must already hold high (administrative) privileges on the device, which drastically reduces real-world risk. EPSS is not provided and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; the only strong positive signal is that public exploit code exists (confirmed via the GitHub repository and VulDB E:P 'Proof-of-Concept' exploit maturity). Note a meaningful discrepancy: the referenced exploit is titled 'importprofile_arbitrary_file_write', implying arbitrary file write, whereas the CVE text and CWE-22 frame this purely as path traversal - arbitrary file write on an embedded router could plausibly justify higher integrity impact than the VulDB-assigned VI:L, so defenders should verify the true impact with the vendor/PoC. Overall: a real but low-severity post-authentication flaw, not an urgent widespread threat.

An attacker who has already authenticated to the H3C Magic NX15 router's management interface with high privileges sends a crafted request to /api/upload invoking the importprofile function with a manipulated fileName parameter containing traversal sequences (e.g. ../../), writing or reading a file outside the intended directory. Public exploit code is available (GitHub: XxingGoD/H3C-NX15-R017-Vulns), lowering the effort to reproduce. Because PR:H is required, exploitation is realistic mainly for already-authorized or credential-compromised actors.