H3C Magic NX15 EUVD-2026-104672

Exploitation targets the sub_416874 function within the /usr/bin/usrlist binary on the H3C Magic NX15 (firmware NX15V100R017) and requires network reachability to that service plus low-level privileges (CVSS PR:L) - i.e. the attacker needs an existing authenticated session or equivalent low-privilege access to the router, which is the primary limiting factor against anonymous internet-wide exploitation. Impact is limited to availability (service crash / DoS, VA:H); there is no confidentiality or integrity impact per the vector, and successful exploitation depends on the vulnerable usrlist code path being reachable in the deployed configuration.

Signals are mostly aligned toward a MODERATE, not critical, priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and describes a network-reachable, low-complexity flaw that requires some privileges (PR:L) and yields ONLY availability impact (VA:H) with no confidentiality or integrity loss - consistent with the GitHub PoC path name 'usrlist_stack_overflow_dos', i.e. a denial-of-service crash rather than code execution. CWE-121 (stack-based buffer overflow) in a native binary could in principle be escalated to code execution, but neither the description nor the CVSS vector claims integrity impact, so treating this as DoS-only is the evidence-based reading. A public exploit exists (GitHub, VulDB-referenced), which raises opportunistic risk, and the vector carries E:P (Proof-of-Concept) - but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active, widespread exploitation. The PR:L requirement means an attacker needs at least low-level authenticated/session access to the router, which meaningfully limits anonymous mass exploitation. Net: a real, publicly-exploitable DoS against a specific consumer router, worth patching, but not an emergency on the level of an unauthenticated RCE. Missing data to note explicitly: no EPSS probability and no KEV status were supplied, so exploitation-likelihood cannot be quantified, and the stated privilege requirement should be confirmed against the vendor's authentication model.

An attacker with low-level access to the H3C Magic NX15 router's management interface sends crafted input that reaches the sub_416874 function in /usr/bin/usrlist, overflowing a stack buffer and crashing the service. Because publicly available exploit code exists (GitHub PoC labeled as a usrlist stack-overflow DoS), a low-skill attacker can reproduce the crash to disrupt router availability. The CVSS vector (AV:N/AC:L/PR:L) indicates a network-reachable, low-complexity attack that nonetheless requires some level of privilege.