Which versions of H3C NX15 are affected by CVE-2026-18812?

H3C NX15 firmware V100R017 contains a command injection vulnerability in the IPv6 WAN configuration API that allows authenticated administrators to execute arbitrary OS commands as root, potentially…

Is there a public PoC exploit available for CVE-2026-18812?

Yes, a public proof-of-concept exploit is available for CVE-2026-18812. Prioritise patching immediately. EPSS: 2.3%.

How to fix or mitigate CVE-2026-18812?

Within 24 hours: Inventory all H3C NX15 devices running V100R017 and restrict administrative access to essential personnel only; deploy network traffic monitoring on the `/api/esps` endpoint for the `workMode` parameter. Within 7 days: Implement network segmentation to isolate affected devices from critical infrastructure; enforce multi-factor authentication for all administrative access to these devices. Within 30 days: Coordinate with H3C for patch availability status and develop a firmware upgrade strategy; evaluate alternative network infrastructure solutions if patches remain unavailable; conduct access audits to detect any unauthorized administrative credential usage.

H3C NX15 CVE-2026-18812

Q: What is the CVSS score of CVE-2026-18812?

CVE-2026-18812 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

EUVD-2026-52898 HIGH

Command Injection (CWE-77)

2026-08-04 VulDB

GHSA-xg9q-jwhp-4c98

Command Injection Nx15

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable API requires high-privilege admin credentials (PR:H); root-level command execution yields full confidentiality, integrity, and availability impact on the device with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 21:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 04, 2026 - 21:01 vuln.today

CVE Published

Aug 04, 2026 - 20:30 cve.org

HIGH 8.6

DescriptionCVE.org

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the workMode parameter in the /api/esps IPv6 WAN configuration endpoint, likely yielding root-level device takeover based on the published PoC repository name. A public proof-of-concept exploit is available on GitHub (E:P confirmed in the CVSS 4.0 vector), significantly lowering the skill bar for anyone who already holds administrative credentials. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation.

Technical ContextAI

The H3C NX15 is a mid-range network gateway device; the affected firmware version is V100R017 (CPE: cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*). The vulnerable component is the API handler function esps.ipv6.wan exposed via the /api/esps REST endpoint, which manages IPv6 WAN interface configuration. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command - 'Command Injection'): the workMode argument supplied by the caller is concatenated into a shell command without adequate sanitization or escaping. This allows an attacker to inject arbitrary shell metacharacters or secondary commands that the device firmware executes at the operating system level. IoT/router firmware of this type commonly invokes system() or popen() calls to delegate network configuration tasks to underlying shell utilities, a pattern that is inherently susceptible to this class of flaw when input is not validated.

RemediationAI

No vendor-released patch has been identified at time of analysis - administrators should monitor VulDB (https://vuldb.com/vuln/385811) and H3C's official security bulletins for firmware updates and apply any released fix promptly. As immediate compensating controls: restrict access to the device management interface (including the /api/esps endpoint) to trusted internal management VLANs only, effectively removing the network attack vector - note this prevents legitimate remote administration. If remote management is operationally required, place the management interface behind a VPN with strong multi-factor authentication to enforce access controls before credentials can be used to reach the vulnerable endpoint. Rotate all administrative credentials immediately to limit the blast radius of any prior credential exposure. Monitor device logs for anomalous POST requests to /api/esps with unusual workMode values. Do not expose the NX15 management interface directly to the internet under any circumstances until a patched firmware version is available.