H3C NX15 CVE-2026-18901

Exploitation requires valid high-privilege (administrative) credentials for the H3C NX15 web management interface - confirmed by PR:H in the CVSS 4.0 vector and the PoC filename prefix postauth_. The /api/esps Web API endpoint must be network-reachable from the attacker's position (AV:N); if the management interface is firewalled or bound only to a management VLAN, remote exploitation is blocked. The affected firmware is specifically V100R017; other versions are not confirmed vulnerable. Limiting factors: authentication is required before the dangerous function can be invoked, meaning unauthenticated attackers cannot exploit this directly. Exploitation is blocked for deployments with strong, unique admin credentials, or with network-level restrictions on the management web interface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 7.3, placing this in the high tier but with a critical caveat: PR:H (high privileges required) means an attacker must first obtain valid administrative credentials before exploiting the endpoint. This significantly narrows the exploitable population compared to unauthenticated flaws. However, the supplemental E:P (exploit proof-of-concept) modifier confirms a working public exploit exists, elevating real-world risk for any deployment where admin credentials are weak, shared, or previously compromised. No CISA KEV listing exists at time of analysis, and EPSS data was not provided in the intelligence feed - exploitation probability cannot be quantified independently. The primary risk signal is the credentialed PoC enabling root RCE on a network appliance: a complete compromise of device integrity, confidentiality, and availability with no scope change to subsequent systems per SC/SI/SA:N. For organizations using H3C NX15 in sensitive network segments, the combination of public PoC and absence of a patch represents a material priority despite the PR:H prerequisite.

An attacker who has obtained valid administrative credentials for an H3C NX15 device - through credential stuffing, phishing, or reuse of default passwords - connects remotely over the network and sends a crafted HTTP POST request to /api/esps, invoking the service.add function with malicious parameters. The exposed dangerous routine executes the attacker's payload at the OS level with root privileges, granting full control of the network appliance. A public PoC script (postauth_service_add_rce.py) automates this attack chain, lowering the skill barrier for exploitation.