15
CVEs
0
Critical
12
High
0
KEV
14
PoC
12
Unpatched C/H
0.0%
Patch Rate
1.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
12
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Magic R100 Firmware
28
Magic R200 Firmware
25
Gr 1200W Firmware
21
Magic Nx18 Plus Firmware
20
Magic R300 2100M Firmware
17
H200 Firmware
16
Magic B1St Firmware
11
B5 Mini Firmware
11
Nx15
9
Seccenter Smp 1114P02
6
N12 Firmware
5
Gr2200 Firmware
2
Magic B1
2
Magic Nx15 Firmware
2
Magic R230 Firmware
2
Magic B0
2
Gr 1800Ax Firmware
2
Magic R3010 Firmware
1
Sr66 Gigabit Firewall Module
1
Er6300G2 Firmware
1
Secpath F100 C G3 Firmware
1
S5820 Secblade Vpn Firewall Module
1
9500 Vpn Firewall Module
1
Er2100N Firmware
1
Gr 8300 Firmware
1
Gr3200 Firmware
1
S1000 E Vpn Firewall Appliance
1
Secpath F5030 D Firmware
1
Mc102 G Firmware
1
Gr 5200 Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18814 | Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary operating system commands via the /api/esps API endpoint by manipulating the reload.reload_config function parameter. The vulnerability, classified as CWE-77 (Command Injection), carries a CVSS 4.0 score of 7.3 and affects this specific H3C networking device firmware version. A public proof-of-concept exploit - titled 'service_add_root_rce' - has been published to GitHub, indicating root-level code execution is achievable; no vendor patch has been identified at time of analysis. | HIGH | 7.3 | 2.7% | 59 |
PoC
No patch
|
| CVE-2026-18900 | OS command injection in H3C NX15 firmware V100R017 enables authenticated remote attackers to execute arbitrary operating system commands by manipulating the File argument in the file.exec function exposed via the /api/esps Backend RPC endpoint. A public Python proof-of-concept exploit script is available on GitHub, substantially lowering the barrier to exploitation for less-skilled actors. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls. | HIGH | 7.3 | 2.4% | 59 |
PoC
No patch
|
| CVE-2026-18902 | Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the unsanitized `my2P4key` argument processed by the `esps.wan.repeater.set/repeaterproc` handler at the `/api/esps` endpoint. The CVSS 4.0 vector confirms high-privilege authentication is required (PR:H), yet successful exploitation yields full host compromise with confidentiality, integrity, and availability all rated High. A public Python proof-of-concept exploit script is available on GitHub, materially raising urgency for administrators of internet-exposed devices or those using default credentials. | HIGH | 7.3 | 2.4% | 59 |
PoC
No patch
|
| CVE-2026-18811 | Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root via the /api/esps management endpoint. The vulnerability exists in the Add function's handling of the esps.filter.url parameter, which is passed unsanitized to a system command (CWE-77). A public proof-of-concept exploit demonstrating root-level remote code execution is available on GitHub, elevating real-world risk beyond the theoretical - though exploitation requires high-privilege credentials, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-18812 | Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the `workMode` parameter in the `/api/esps` IPv6 WAN configuration endpoint, likely yielding root-level device takeover based on the published PoC repository name. A public proof-of-concept exploit is available on GitHub (E:P confirmed in the CVSS 4.0 vector), significantly lowering the skill bar for anyone who already holds administrative credentials. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-18813 | Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute arbitrary OS commands by supplying a maliciously crafted value in the `esps.apcm.version` argument of a DELETE request to the `/api/esps` API endpoint. The exploit has been publicly disclosed on GitHub, raising the risk for exposed devices with reachable management interfaces. No active CISA KEV listing exists, but the publicly available proof-of-concept lowers the bar for motivated attackers who already hold administrative credentials. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-6560 | Buffer overflow in H3C Magic B0 routers (firmware versions up to 100R002) allows authenticated remote attackers to achieve arbitrary code execution via the Edit_BasicSSID function in /goform/aspForm. Public exploit code exists on GitHub. CVSS4.0 7.4 reflects network accessibility with low authentication (PR:L). Vendor unresponsive to disclosure - no patch confirmed. Exploitation requires valid router credentials but no special deployment conditions. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6563 | Buffer overflow in H3C Magic B1 router firmware (versions through 100R004) allows authenticated remote attackers to achieve complete system compromise via crafted parameters to the SetAPWifiorLedInfoById function in /goform/aspForm. Public exploit code exists on GitHub. CVSS 7.4 (High) with network attack vector, low complexity, and confirmed proof-of-concept (CVSS:4.0 E:P). Vendor unresponsive to disclosure. EPSS and KEV status not provided in available data. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6581 | Remote code execution in H3C Magic B1 router firmware versions up to 100R004 allows authenticated attackers to trigger a buffer overflow in the SetMobileAPInfoById function via crafted HTTP requests to /goform/aspForm. CVSS:4.0 rated 7.4 (High) with confirmed publicly available exploit code on GitHub. No vendor response or patch available. EPSS data not provided, but public exploit availability significantly elevates exploitation risk. The CWE-120 buffer overflow enables full device compromise (VC:H/VI:H/VA:H) with low attack complexity (AC:L) requiring only low-privileged authentication (PR:L). | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-9393 | Buffer overflow in the H3C Magic B0 router (firmware up to 100R002) allows authenticated remote attackers to corrupt memory via the param argument handled by the Edit_BasicSSID_5G function in /goform/aspForm, leading to high impact on confidentiality, integrity, and availability. Publicly available exploit code exists per VulDB, though EPSS remains very low (0.04%, 13th percentile) and the issue is not listed in CISA KEV, indicating no public exploit identified as actively used at time of analysis. The vendor was contacted but did not respond, increasing risk of an unpatched window for exposed devices. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-18901 | Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the `/api/esps` Web API endpoint, which exposes the `service.add` function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (`postauth_service_add_rce.py`) is publicly available on GitHub, demonstrating a complete root RCE chain. No vendor patch has been identified at time of analysis; no active exploitation is confirmed in CISA KEV. | HIGH | 7.3 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-8764 | Remote buffer overflow in H3C Magic B3 routers (firmware up to 100R002) allows attackers with high privileges to corrupt memory via the UpdateWanParams function in /goform/aspForm by manipulating the param argument. Publicly available exploit code exists per VulDB disclosure, though the vendor did not respond to coordinated disclosure attempts. With CVSS 4.0 score of 7.3 and PR:H requirement, exploitation hinges on prior administrative access to the device's web interface. | HIGH | 7.3 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-15479 | Unauthenticated remote password modification on H3C NX15 V100R017 routers allows any network-reachable attacker to overwrite the administrator password via the change_passwd function at the /api/login/modify endpoint, effectively seizing full administrative control of the device. The vulnerability stems from a missing authentication or authorization check on the password modification API (CWE-640), meaning no credentials or session token are required to invoke it. A public proof-of-concept exploit is available on GitHub, and no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-15907 | SQL injection in H3C SecPath F1000-C8300 (firmware up to 20260522) allows unauthenticated remote attackers to manipulate database queries via the `subject` parameter in the `/webui/?g=log_fw_nbc_mail_jsondata` web management endpoint. The vendor has confirmed the vulnerability and acknowledged a planned fix, but no patch is released as of the disclosure date. A publicly available exploit exists (hosted on Feishu), lowering the bar for exploitation significantly despite the moderate CVSS 4.0 score of 5.5. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-18810 | Unauthenticated access to the network setup wizard API in H3C NX15 firmware V100R017 allows remote attackers to interact with the /api/wizard/networkSetup endpoint without presenting valid credentials. The root cause is CWE-306 - missing authentication for a critical function - meaning the device exposes a privileged configuration path with no access control gate. A public proof-of-concept repository exists on GitHub, confirming exploitability; no CISA KEV listing was identified at time of analysis, suggesting exploitation has not yet been confirmed at scale. | MEDIUM | 6.9 | 0.4% | 35 |
No patch
|