H3C Magic NX15 firmware version 100R017 has a critical OS command injection flaw in /usr/bin/usrlist that can be exploited remotely, and a public proof-of-concept exploit is available.
What Is It
CVE-2026-112370 is an OS command injection vulnerability (CWE-77, CWE-78) in the H3C Magic NX15. It sits in the function sub_416874 inside the /usr/bin/usrlist binary. According to the NVD record, manipulating input to this function leads to OS command injection, and the attack can be carried out remotely. VulDB, the CNA, published the record on 2026-10-19. NVD lists its status as "Received," which means NVD has not finished its analysis yet.
Why It Matters
- Severity: CVSS 3.1 base score of 9.9 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The secondary CVSS 4.0 score is 8.6 (HIGH), and the CVSS 2.0 score is 9.0. - Attack conditions: The attack works over the network with low complexity and needs no user interaction. It does require low-level privileges (CVSS 2.0: single authentication).
- Impact: Confidentiality, integrity and availability impacts are all rated high. Under CVSS 3.1 the scope is changed, so the impact can reach beyond the vulnerable component.
- Exploit availability: The record says the exploit "has been made public and could be used." The CVSS 4.0 exploit maturity is Proof-of-Concept, and the references include a public PoC repository. The researcher's repository path labels the issue as a root-level RCE (
usrlist_cmdi_root_rce). - KEV status: As of 2026-10-19, CVE-2026-112370 is not listed in the CISA Known Exploited Vulnerabilities Catalog. That means CISA has not confirmed active exploitation in the wild at this time.
What's Vulnerable
- Vendor: H3C
- Product: Magic NX15
- Affected version: 100R017
- CPE:
cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:*
The supplied data does not list any other affected or unaffected versions.
Patch Status
The supplied material does not mention a vendor patch, fixed firmware version, or official advisory. The NVD description says only that "the vendor was contacted early about this disclosure," and it does not say whether the vendor responded. Because this CVE is not in the CISA KEV catalog, CISA has not set a required action or due date. Organizations running Magic NX15 firmware 100R017 should check H3C directly for updated firmware. With a public PoC available, they should also limit network access to these devices' management interfaces and keep the number of authenticated accounts to a minimum until a fix is confirmed.