H3C NX15 CVE-2026-18812

Exploitation requires valid high-privilege administrative credentials for the H3C NX15 management API (PR:H in the CVSS 4.0 vector) - an attacker must first obtain or possess these credentials. The attack targets the specific /api/esps endpoint's IPv6 WAN configuration function (esps.ipv6.wan), meaning the device must have this API endpoint network-accessible to the attacker (AV:N). Firmware version must be V100R017 specifically, as confirmed by EUVD-2026-52898. No special non-default configuration or user interaction is required beyond authentication. Key limiting factors: (1) the hard authentication prerequisite (PR:H) - unauthenticated attackers cannot exploit this directly; (2) the device must be running the specific affected firmware version; (3) the management API must be reachable from the attacker's network position. The vulnerability does NOT require physical access, local access, or victim user interaction after authentication is satisfied.

The CVSS 4.0 base score of 7.3 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) captures the tension accurately: the attack vector is fully remote with no complexity or user interaction required, but exploitation is gated behind high-privilege (PR:H) authentication. This single constraint substantially limits the realistic attack surface compared to an unauthenticated flaw. However, the publicly available PoC on GitHub - confirmed by both the reference list and the CVSS 4.0 E:P (exploit proof-of-concept) supplemental metric - means any actor who obtains or guesses admin credentials can trivially weaponize the vulnerability without needing to develop their own exploit. No EPSS score was provided in the input, so probability-of-exploitation-in-the-wild cannot be quantified; however, the absence of a CISA KEV entry suggests no confirmed mass exploitation. For organizations with internet-exposed NX15 management interfaces or environments where admin credential hygiene is poor, practical risk is elevated well beyond what the 7.3 score implies on paper. For those with management access strictly restricted to internal networks, this is medium priority pending a vendor patch.

An attacker who has obtained valid administrative credentials - through credential stuffing, phishing, or reuse from another compromised system - sends a crafted HTTP POST request to the /api/esps endpoint with a workMode parameter value containing shell metacharacters (e.g., ; id # or a reverse shell payload). The firmware processes the parameter without sanitization and executes the injected command at the OS level, returning a root shell to the attacker. The public PoC at https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps_ipv6_wan_set_workmode_root_rce confirms this path leads to root-level remote code execution, enabling full device compromise and potential network pivoting.