19
CVEs
1
Critical
15
High
0
KEV
18
PoC
16
Unpatched C/H
0.0%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
15
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Magic R100 Firmware
28
Magic R200 Firmware
25
Gr 1200W Firmware
21
Magic Nx18 Plus Firmware
20
Magic R300 2100M Firmware
17
H200 Firmware
16
Magic B1St Firmware
11
B5 Mini Firmware
11
Nx15
9
Seccenter Smp 1114P02
6
N12 Firmware
5
Gr2200 Firmware
2
Magic B1
2
Magic Nx15 Firmware
2
Magic R230 Firmware
2
Magic B0
2
Gr 1800Ax Firmware
2
Magic R3010 Firmware
1
Sr66 Gigabit Firewall Module
1
Er6300G2 Firmware
1
Secpath F100 C G3 Firmware
1
S5820 Secblade Vpn Firewall Module
1
9500 Vpn Firewall Module
1
Er2100N Firmware
1
Gr 8300 Firmware
1
Gr3200 Firmware
1
S1000 E Vpn Firewall Appliance
1
Secpath F5030 D Firmware
1
Mc102 G Firmware
1
Gr 5200 Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-60262 | H3C wireless controllers (M102G) and access points (BA1500L) have a vsftpd misconfiguration that grants root ownership to anonymously uploaded FTP files. Attackers can upload malicious files that execute with root privileges, gaining full device control. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2025-14015 | A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2026-3701 | Remote code execution in H3C Magic B1 firmware through a buffer overflow in the SSID configuration function allows unauthenticated attackers to gain complete system compromise over the network. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification. The flaw affects firmware versions up to 100R004 and requires only low complexity to exploit with valid credentials. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-18814 | Command injection in H3C NX15 firmware V100R017 permits network-accessible, authenticated attackers to execute arbitrary operating system commands via the /api/esps API endpoint by manipulating the reload.reload_config function parameter. The vulnerability, classified as CWE-77 (Command Injection), carries a CVSS 4.0 score of 7.3 and affects this specific H3C networking device firmware version. A public proof-of-concept exploit - titled 'service_add_root_rce' - has been published to GitHub, indicating root-level code execution is achievable; no vendor patch has been identified at time of analysis. | HIGH | 7.3 | 2.7% | 59 |
PoC
No patch
|
| CVE-2026-18900 | OS command injection in H3C NX15 firmware V100R017 enables authenticated remote attackers to execute arbitrary operating system commands by manipulating the File argument in the file.exec function exposed via the /api/esps Backend RPC endpoint. A public Python proof-of-concept exploit script is available on GitHub, substantially lowering the barrier to exploitation for less-skilled actors. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls. | HIGH | 7.3 | 2.4% | 59 |
PoC
No patch
|
| CVE-2026-18902 | Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the unsanitized `my2P4key` argument processed by the `esps.wan.repeater.set/repeaterproc` handler at the `/api/esps` endpoint. The CVSS 4.0 vector confirms high-privilege authentication is required (PR:H), yet successful exploitation yields full host compromise with confidentiality, integrity, and availability all rated High. A public Python proof-of-concept exploit script is available on GitHub, materially raising urgency for administrators of internet-exposed devices or those using default credentials. | HIGH | 7.3 | 2.4% | 59 |
PoC
No patch
|
| CVE-2026-18811 | Command injection in H3C NX15 V100R017 allows authenticated remote attackers to execute arbitrary OS commands as root via the /api/esps management endpoint. The vulnerability exists in the Add function's handling of the esps.filter.url parameter, which is passed unsanitized to a system command (CWE-77). A public proof-of-concept exploit demonstrating root-level remote code execution is available on GitHub, elevating real-world risk beyond the theoretical - though exploitation requires high-privilege credentials, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-18812 | Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers to execute arbitrary OS commands via the `workMode` parameter in the `/api/esps` IPv6 WAN configuration endpoint, likely yielding root-level device takeover based on the published PoC repository name. A public proof-of-concept exploit is available on GitHub (E:P confirmed in the CVSS 4.0 vector), significantly lowering the skill bar for anyone who already holds administrative credentials. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-18813 | Command injection in H3C NX15 firmware V100R017 allows authenticated remote attackers with high privileges to execute arbitrary OS commands by supplying a maliciously crafted value in the `esps.apcm.version` argument of a DELETE request to the `/api/esps` API endpoint. The exploit has been publicly disclosed on GitHub, raising the risk for exposed devices with reachable management interfaces. No active CISA KEV listing exists, but the publicly available proof-of-concept lowers the bar for motivated attackers who already hold administrative credentials. | HIGH | 7.3 | 2.3% | 59 |
PoC
No patch
|
| CVE-2026-6560 | Buffer overflow in H3C Magic B0 routers (firmware versions up to 100R002) allows authenticated remote attackers to achieve arbitrary code execution via the Edit_BasicSSID function in /goform/aspForm. Public exploit code exists on GitHub. CVSS4.0 7.4 reflects network accessibility with low authentication (PR:L). Vendor unresponsive to disclosure - no patch confirmed. Exploitation requires valid router credentials but no special deployment conditions. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6563 | Buffer overflow in H3C Magic B1 router firmware (versions through 100R004) allows authenticated remote attackers to achieve complete system compromise via crafted parameters to the SetAPWifiorLedInfoById function in /goform/aspForm. Public exploit code exists on GitHub. CVSS 7.4 (High) with network attack vector, low complexity, and confirmed proof-of-concept (CVSS:4.0 E:P). Vendor unresponsive to disclosure. EPSS and KEV status not provided in available data. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6581 | Remote code execution in H3C Magic B1 router firmware versions up to 100R004 allows authenticated attackers to trigger a buffer overflow in the SetMobileAPInfoById function via crafted HTTP requests to /goform/aspForm. CVSS:4.0 rated 7.4 (High) with confirmed publicly available exploit code on GitHub. No vendor response or patch available. EPSS data not provided, but public exploit availability significantly elevates exploitation risk. The CWE-120 buffer overflow enables full device compromise (VC:H/VI:H/VA:H) with low attack complexity (AC:L) requiring only low-privileged authentication (PR:L). | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-9393 | Buffer overflow in the H3C Magic B0 router (firmware up to 100R002) allows authenticated remote attackers to corrupt memory via the param argument handled by the Edit_BasicSSID_5G function in /goform/aspForm, leading to high impact on confidentiality, integrity, and availability. Publicly available exploit code exists per VulDB, though EPSS remains very low (0.04%, 13th percentile) and the issue is not listed in CISA KEV, indicating no public exploit identified as actively used at time of analysis. The vendor was contacted but did not respond, increasing risk of an unpatched window for exposed devices. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-18901 | Remote code execution as root is achievable against H3C NX15 firmware V100R017 via the `/api/esps` Web API endpoint, which exposes the `service.add` function without adequate access controls (CWE-749). Exploitation requires high-privilege authentication, but a post-authentication proof-of-concept script (`postauth_service_add_rce.py`) is publicly available on GitHub, demonstrating a complete root RCE chain. No vendor patch has been identified at time of analysis; no active exploitation is confirmed in CISA KEV. | HIGH | 7.3 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-8764 | Remote buffer overflow in H3C Magic B3 routers (firmware up to 100R002) allows attackers with high privileges to corrupt memory via the UpdateWanParams function in /goform/aspForm by manipulating the param argument. Publicly available exploit code exists per VulDB disclosure, though the vendor did not respond to coordinated disclosure attempts. With CVSS 4.0 score of 7.3 and PR:H requirement, exploitation hinges on prior administrative access to the device's web interface. | HIGH | 7.3 | 0.0% | 57 |
PoC
No patch
|