Which versions of H3C NX15 are affected by EUVD-2026-53030?

H3C NX15 firmware V100R017 contains a remote code execution vulnerability allowing high-privilege users to execute arbitrary code with root access; publicly available exploit code exists.

Is there a public PoC exploit available for EUVD-2026-53030?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53030. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-53030?

Within 24 hours: Identify all systems running H3C NX15 firmware V100R017 and assess exposure-specifically whether high-privilege user accounts can access the device remotely. Within 7 days: Implement firewall or Web Application Firewall rules to restrict access to the `/api/esps` endpoint; require multi-factor authentication for all high-privilege accounts; enable comprehensive API request logging and configure real-time alerts for suspicious service add operations. Within 30 days: Contact H3C vendor support to obtain patch timelines and firmware upgrade options; develop and test a migration plan for systems that cannot be upgraded; establish a backup and recovery procedure for rapid restoration if exploitation occurs.

H3C NX15 EUVD-2026-53030

Q: What is the CVSS score of EUVD-2026-53030?

EUVD-2026-53030 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-18901 HIGH

Exposed Dangerous Method or Function (CWE-749)

2026-08-05 VulDB

GHSA-8576-m87r-pjc9

Information Disclosure Nx15 H3C

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable API endpoint requires high-privilege authentication (PR:H); low complexity post-auth exploit achieves full system compromise with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 05:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 05:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:01 vuln.today

CVE Published

Aug 05, 2026 - 04:00 cve.org

HIGH 8.6

DescriptionCVE.org

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the /api/esps Web API endpoint, which exposes the service.add function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (postauth_service_add_rce.py) is publicly available on GitHub, demonstrating a complete root RCE chain. No vendor patch has been identified at time of analysis; no active exploitation is confirmed in CISA KEV.

Technical ContextAI

The H3C NX15 is a network appliance (CPE: cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*) running firmware version V100R017. The vulnerability is rooted in CWE-749 (Exposed Dangerous Method or Function): the Web API endpoint /api/esps makes the internal service.add function callable by authenticated remote users without restricting it to a safe subset of operations. The public PoC repository is titled service_add_root_rce_chain, indicating the exposed routine provides a path to OS-level code execution with root privileges - consistent with the CVSS 4.0 metrics VC:H/VI:H/VA:H. The attack surface is the device's HTTP-based management Web API, typical of embedded networking firmware architectures.

RemediationAI

No vendor-released patch has been publicly identified at time of analysis. Organizations should contact H3C (New H3C Group) directly to request a firmware fix or security advisory for NX15 V100R017. As an immediate compensating control, restrict access to the device's Web API management interface (the /api/esps endpoint) to trusted administrative subnets only via ACLs or firewall rules - this prevents remote exploitation without disrupting device operation. If remote web management is not operationally required, disable it entirely on internet-facing interfaces. Enforce strong, unique administrative credentials and audit for shared or default passwords, as PR:H exploitation depends on credential access. Monitor for unauthorized HTTP POST requests targeting /api/esps in web access logs. Reference the public PoC at https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/service_add_root_rce_chain/poc/postauth_service_add_rce.py to understand exact request patterns for IDS/WAF signature creation.