EUVD-2026-43201
GHSA-rg9f-h2v7-xh94
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable password reset yields full admin control, warranting C:H/I:H/A:H despite provided score's low-impact metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
AnalysisAI
Unauthenticated remote password modification on H3C NX15 V100R017 routers allows any network-reachable attacker to overwrite the administrator password via the change_passwd function at the /api/login/modify endpoint, effectively seizing full administrative control of the device. The vulnerability stems from a missing authentication or authorization check on the password modification API (CWE-640), meaning no credentials or session token are required to invoke it. A public proof-of-concept exploit is available on GitHub, and no vendor patch has been identified at time of analysis.
Technical ContextAI
The H3C NX15 is a consumer or SMB-grade wireless router manufactured by H3C (a Chinese networking vendor). The affected component is the Administrator Password Modification Endpoint exposed at /api/login/modify, handled by the server-side function change_passwd. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) describes a failure to enforce identity verification before permitting credential changes - in this case, the API accepts a newPass parameter and applies it without requiring the caller to supply valid session credentials, a current password, or a secure reset token. The CPE string cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:* covers all sub-versions of the NX15 application stack under firmware V100R017. The GitHub repository path (pre_auth_pwd_change) independently corroborates that the exploitation path is pre-authentication, not a privilege-escalation from a low-privilege session.
RemediationAI
No vendor-released patch has been identified at time of analysis - affected organizations should monitor the H3C security advisory portal for a firmware update addressing CVE-2026-15479. In the interim, the most effective compensating control is to restrict access to the device management interface (/api/login/modify and the broader web admin surface) to trusted internal IP ranges using an upstream firewall or the device's own access control lists, preventing internet-facing or guest-network exposure to the vulnerable endpoint. If the web management interface is not required from untrusted network segments, disabling remote management entirely eliminates the attack surface with no operational side effects for most deployments. Additionally, rotating the administrator password immediately after any exposure window and enabling alerting on login events can help detect post-exploitation. VulDB references: https://vuldb.com/vuln/377785 and the public exploit repository at https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/pre_auth_pwd_change should be reviewed for full technical scope.
Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary
Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the un
OS command injection in H3C NX15 firmware V100R017 enables authenticated remote attackers to execute arbitrary operating
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute ar
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands v
Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root vi
Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the `/api/esps` Web API endpoint, whi
Unauthenticated access to the network setup wizard API in H3C NX15 firmware V100R017 allows remote attackers to interact
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today