Which versions of H3C NX15 are affected by CVE-2026-18902?

H3C NX15 network devices (version V100R017) contain a command injection vulnerability allowing authenticated administrators to execute arbitrary system commands, resulting in complete device…

Is there a public PoC exploit available for CVE-2026-18902?

Yes, a public proof-of-concept exploit is available for CVE-2026-18902. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-18902?

Within 24 hours, immediately isolate all H3C NX15 V100R017 devices from internet-facing access and reset default administrative credentials to complex, unique passwords; review authentication logs and audit `/api/esps` endpoint activity for suspicious `esps.wan.repeater.set/repeaterproc` requests containing `my2P4key` parameters. Within 7 days, implement network segmentation restricting administrative access to trusted management subnets only, deploy API gateway or WAF rules to monitor and block abnormal `/api/esps` requests, and enable comprehensive logging of all command execution on these devices. Within 30 days, contact H3C for emergency patches or firmware updates, evaluate replacing affected devices with alternative vendors, and conduct a complete inventory audit of all H3C NX15 systems to identify any internet-exposed or high-risk deployments.

H3C NX15 CVE-2026-18902

Q: What is the CVSS score of CVE-2026-18902?

CVE-2026-18902 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-53045 HIGH

Command Injection (CWE-77)

2026-08-05 VulDB

GHSA-g9v7-27wr-m7r3

Command Injection Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable API requires high-privilege authentication (PR:H); full CIA impact on the device itself with no scope change into adjacent systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 06:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 06:22 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 06:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:53 vuln.today

CVE Published

Aug 05, 2026 - 04:30 cve.org

HIGH 8.6

DescriptionCVE.org

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the unsanitized my2P4key argument processed by the esps.wan.repeater.set/repeaterproc handler at the /api/esps endpoint. The CVSS 4.0 vector confirms high-privilege authentication is required (PR:H), yet successful exploitation yields full host compromise with confidentiality, integrity, and availability all rated High. A public Python proof-of-concept exploit script is available on GitHub, materially raising urgency for administrators of internet-exposed devices or those using default credentials.

Technical ContextAI

The H3C NX15 is a SOHO Wi-Fi router/repeater running firmware V100R017, identified by CPE cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*. The REST-style management API endpoint /api/esps exposes the esps.wan.repeater.set function via the repeaterproc handler, which processes WAN repeater and wireless configuration parameters. The my2P4key argument - likely a 2.4 GHz WPA passphrase field - is passed without sanitization into an OS-level command execution call, constituting a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) defect. Shell metacharacters embedded in the argument are interpreted directly by the underlying shell, giving the attacker arbitrary command execution in the context of the web service process.

RemediationAI

No vendor-released patch has been identified at time of analysis - none of the available references (VulDB at https://vuldb.com/vuln/385936 or the researcher's GitHub at https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc/report/postauth_esps_wan_repeater_repeaterproc_rce_report.md) link to an official H3C advisory or patched firmware image. As an immediate compensating control, restrict access to the device's management interface by disabling remote (WAN-side) administration if not operationally required - this removes the network attack vector entirely but may affect legitimate remote management workflows. If management access must remain available, enforce IP allowlisting via firewall rules to limit reachability to trusted hosts. Rotate any default or weak administrator credentials immediately, since PR:H exploitation depends entirely on credential access. Monitor https://vuldb.com/vuln/385936 and the official H3C firmware repository for a patched V100R017 release or successor firmware addressing this issue.