H3C NX15 CVE-2026-15479

No special conditions are required for exploitation beyond network-level reachability of the HTTP/HTTPS management port on the H3C NX15. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N - the endpoint is exposed by default as part of the device's web administration interface, requires no authentication (PR:N), no prior session establishment, and no victim interaction. The only limiting factor is network exposure: if the management interface is bound only to the LAN-side interface and not reachable from the WAN or untrusted networks, an attacker must first achieve LAN adjacency. Exploitation does not require a specific browser, operating system, or custom protocol - a plain HTTP POST with the newPass parameter is sufficient. No non-default configuration flag enables or disables the vulnerable endpoint independently.

The CVSS 4.0 vector provided (AV:N/AC:L/AT:N/PR:N/UI:N) correctly captures the attack surface - unauthenticated, network-reachable, no complexity - but the impact metrics (VC:L/VI:L/VA:L) materially understate the practical impact of an unauthenticated admin password reset, which effectively constitutes full device takeover. An independent assessment places confidentiality, integrity, and availability impact all at High given that admin credential ownership on a router yields full control over routing, DNS, firewall rules, and connected network traffic. The EPSS score is not provided, but the combination of: a public POC on GitHub, trivial exploitation prerequisites (AV:N/AC:L/PR:N/UI:N), and a widely-targeted device class (home/SMB routers) suggests elevated real-world exploitation risk even in the absence of CISA KEV listing. This is NOT a high-CVSS-but-low-real-risk case - the exploitation is mechanically simple and the impact is operationally severe. The KEV status is not confirmed, but the public POC lowers the barrier to opportunistic exploitation significantly.

An attacker performing an internet-wide scan discovers an H3C NX15 router with its web management port exposed; they send a crafted unauthenticated HTTP POST request to /api/login/modify with a chosen newPass value, immediately resetting the administrator password without any credential validation. The attacker then logs into the admin console with the newly set password, gaining full control over the device's network configuration, DNS settings, and firewall rules. The public GitHub POC at coconut652-7/IOT_Vul_Public confirms this attack path requires no authentication and no special tooling beyond a standard HTTP client.