EUVD-2026-53030
GHSA-8576-m87r-pjc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API endpoint requires high-privilege authentication (PR:H); low complexity post-auth exploit achieves full system compromise with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the /api/esps Web API endpoint, which exposes the service.add function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (postauth_service_add_rce.py) is publicly available on GitHub, demonstrating a complete root RCE chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid high-privilege (administrative) credentials for the H3C NX15 web management interface - confirmed by PR:H in the CVSS 4.0 vector and the PoC filename prefix `postauth_`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 7.3, placing this in the high tier but with a critical caveat: PR:H (high privileges required) means an attacker must first obtain valid administrative credentials before exploiting the endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been publicly identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running H3C NX15 firmware V100R017 and assess exposure-specifically whether high-privilege user accounts can access the device remotely. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary
Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the un
OS command injection in H3C NX15 firmware V100R017 enables authenticated remote attackers to execute arbitrary operating
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute ar
Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands v
Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root vi
Unauthenticated remote password modification on H3C NX15 V100R017 routers allows any network-reachable attacker to overw
Unauthenticated access to the network setup wizard API in H3C NX15 firmware V100R017 allows remote attackers to interact
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today