Which versions of H3C NX15 are affected by CVE-2026-18813?

H3C NX15 firmware V100R017 contains a vulnerability allowing high-level administrators to compromise network infrastructure through remote command execution.

Is there a public PoC exploit available for CVE-2026-18813?

Yes, a public proof-of-concept exploit is available for CVE-2026-18813. Prioritise patching immediately. EPSS: 2.3%.

How to fix or mitigate CVE-2026-18813?

Within 24 hours, inventory all H3C NX15 V100R017 devices and audit administrative access logs for unauthorized activity. Within 7 days, restrict management interface access through network segmentation and firewall rules, enable comprehensive API logging, and disable the `/api/esps` endpoint if operationally feasible. Within 30 days, monitor H3C vendor advisories for patch availability, implement multi-factor authentication for all administrative accounts, reduce the number of high-privilege users, and evaluate device replacement or upgrade options.

H3C NX15 CVE-2026-18813

Q: What is the CVSS score of CVE-2026-18813?

CVE-2026-18813 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.3%.

EUVD-2026-52927 HIGH

Command Injection (CWE-77)

2026-08-04 VulDB

GHSA-748v-r7q3-7wp2

Command Injection Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible REST API requires administrator credentials (PR:H); no scope change as the 4.0 vector shows SC:N/SI:N/SA:N, confirming impact is contained to the vulnerable device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 21:36 vuln.today

CVSS changed

Aug 04, 2026 - 21:22 NVD

8.6 (HIGH) 7.3 (HIGH)

CVE Published

Aug 04, 2026 - 21:00 cve.org

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute arbitrary OS commands by supplying a maliciously crafted value in the esps.apcm.version argument of a DELETE request to the /api/esps API endpoint. The exploit has been publicly disclosed on GitHub, raising the risk for exposed devices with reachable management interfaces. No active CISA KEV listing exists, but the publicly available proof-of-concept lowers the bar for motivated attackers who already hold administrative credentials.

Technical ContextAI

The H3C NX15 is a networking device (router/access point class) manufactured by H3C Technology Co. running proprietary firmware. The affected firmware version is V100R017, identified via CPE cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*, with the wildcard version field suggesting broader applicability across NX15 sub-releases. The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), where the delete function of the /api/esps REST endpoint passes the user-supplied esps.apcm.version parameter to an underlying OS shell command without adequate sanitization. Shell metacharacters or command separators embedded in this argument are interpreted by the firmware's command interpreter, leading to arbitrary OS command execution.

RemediationAI

No vendor-released patch has been identified at time of analysis - H3C has not published a confirmed fix version in the available references. As compensating controls, administrators should immediately restrict access to the device management interface (including the /api/esps endpoint) to trusted internal management networks only, blocking all external or untrusted network access via firewall rules. Disabling remote administration over the public internet and enforcing VPN-only management access are strongly recommended; this prevents unauthenticated network reachability to the vulnerable endpoint and limits exploitation to already-trusted network segments. Review and rotate all administrative credentials for affected NX15 devices to reduce risk from credential reuse. Monitor VulDB entry https://vuldb.com/vuln/385812 and H3C's official security channels for patch availability. Note: restricting network access to the management plane does not eliminate the vulnerability but substantially increases the difficulty of exploitation.