Magic Nx15
Monthly
Code injection in the H3C Magic NX15 home router (firmware NX15V100R017) allows a low-privilege authenticated attacker to manipulate the `path` argument of the `write` function exposed at /api/esps and achieve arbitrary file writes that escalate to root-level remote code execution. The flaw is remotely reachable over the RPC management interface (CVSS 4.0 score 8.6, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, availability and subsequent-system impact; assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the PR:L prerequisite and the network exposure of the management interface acting as the main practical limits rather than attack complexity. Publicly available exploit code exists, including a published proof-of-concept for the file-write-to-root-RCE chain; no CISA KEV entry or confirmed in-the-wild exploitation was provided in the source data.
OS command injection in the H3C Magic NX15 consumer router (confirmed on firmware 100R017) lets a remote attacker who already holds a low-privilege authenticated session run arbitrary operating-system commands on the device via the sub_416874 function of /usr/bin/usrlist. The flaw scores 8.6 under CVSS v4.0 and 8.6-equivalent High under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N with full C/I/A impact), and publicly available exploit code exists - a working proof-of-concept and writeup for the usrlist command-injection path have been published on GitHub. The vulnerability is not listed in CISA KEV, so this is a public-PoC threat rather than a confirmed in-the-wild campaign; the practical risk hinges on whether the management interface is reachable from an untrusted network, since default deployments typically keep it LAN-side.
Stack-based buffer overflow in H3C Magic NX15 firmware NX15V100R017 can be triggered remotely through the /usr/bin/usrlist function sub_416874, causing a denial-of-service condition by crashing the affected service. Exploitation requires network reachability plus low-level privileges (CVSS PR:L), so an attacker needs an existing authenticated session or equivalent low-privilege access to the router. Publicly available exploit code exists, but the independent CVSS:3.1 assessment is availability-only with PR:L and points to moderate, not critical, priority.
Path traversal in the H3C Magic NX15 router (firmware V100R017) allows a user who already holds administrative rights on the device's management interface to write files outside the intended import location by supplying directory-traversal sequences in the fileName argument of the importprofile function at /api/upload. The flaw is network-reachable and needs no user interaction, but the CVSS vector specifies PR:H, so it is a post-authentication issue that presupposes privileged router credentials rather than an unauthenticated remote compromise; impact is limited to low confidentiality, integrity and availability effects, which is reflected in the low base score. Publicly available exploit code exists - a GitHub repository documenting the arbitrary file write against NX15R017 has been published - but exploitation has not been confirmed as active (no CISA KEV listing), and the overall risk is low-priority despite remote reachability.
Code injection in the H3C Magic NX15 home router (firmware NX15V100R017) allows a low-privilege authenticated attacker to manipulate the `path` argument of the `write` function exposed at /api/esps and achieve arbitrary file writes that escalate to root-level remote code execution. The flaw is remotely reachable over the RPC management interface (CVSS 4.0 score 8.6, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, availability and subsequent-system impact; assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the PR:L prerequisite and the network exposure of the management interface acting as the main practical limits rather than attack complexity. Publicly available exploit code exists, including a published proof-of-concept for the file-write-to-root-RCE chain; no CISA KEV entry or confirmed in-the-wild exploitation was provided in the source data.
OS command injection in the H3C Magic NX15 consumer router (confirmed on firmware 100R017) lets a remote attacker who already holds a low-privilege authenticated session run arbitrary operating-system commands on the device via the sub_416874 function of /usr/bin/usrlist. The flaw scores 8.6 under CVSS v4.0 and 8.6-equivalent High under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N with full C/I/A impact), and publicly available exploit code exists - a working proof-of-concept and writeup for the usrlist command-injection path have been published on GitHub. The vulnerability is not listed in CISA KEV, so this is a public-PoC threat rather than a confirmed in-the-wild campaign; the practical risk hinges on whether the management interface is reachable from an untrusted network, since default deployments typically keep it LAN-side.
Stack-based buffer overflow in H3C Magic NX15 firmware NX15V100R017 can be triggered remotely through the /usr/bin/usrlist function sub_416874, causing a denial-of-service condition by crashing the affected service. Exploitation requires network reachability plus low-level privileges (CVSS PR:L), so an attacker needs an existing authenticated session or equivalent low-privilege access to the router. Publicly available exploit code exists, but the independent CVSS:3.1 assessment is availability-only with PR:L and points to moderate, not critical, priority.
Path traversal in the H3C Magic NX15 router (firmware V100R017) allows a user who already holds administrative rights on the device's management interface to write files outside the intended import location by supplying directory-traversal sequences in the fileName argument of the importprofile function at /api/upload. The flaw is network-reachable and needs no user interaction, but the CVSS vector specifies PR:H, so it is a post-authentication issue that presupposes privileged router credentials rather than an unauthenticated remote compromise; impact is limited to low confidentiality, integrity and availability effects, which is reflected in the low base score. Publicly available exploit code exists - a GitHub repository documenting the arbitrary file write against NX15R017 has been published - but exploitation has not been confirmed as active (no CISA KEV listing), and the overall risk is low-priority despite remote reachability.