CVE-2026-112371 is a critical code injection flaw in the RPC Interface of H3C Magic NX15 firmware NX15V100R017; it can be exploited remotely, and a public exploit has been disclosed.
What Is It
The flaw is in the write function of /api/esps, part of the device's RPC Interface. Manipulating the path argument can lead to code injection. The CNA (VulDB) classifies it as CWE-74 (Injection) and CWE-94 (Code Injection). The researcher reference is titled "file_write_root_rce", which points to arbitrary file write that ends in remote code execution.
The CVE was published to NVD on 2026-10-19. Its NVD status is "Received", which means NVD has not yet completed its own analysis.
Why It Matters
- CVSS 3.1: 9.9 (Critical):
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The attack is network-based and low-complexity. It needs only low privileges and no user interaction, and the scope is changed. - CVSS 4.0: 8.6 (High), with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 9.0 (High), requiring single authentication.
The description says the exploit "has been publicly disclosed and may be utilized." A public proof-of-concept is linked in the references. Confidentiality, integrity and availability impacts are all rated High.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no KEV entry was provided. Active exploitation in the wild has not been confirmed by KEV.
What's Vulnerable
- Vendor: H3C
- Product: Magic NX15
- Component: RPC Interface (
/api/esps,writefunction) - Affected version: NX15V100R017
- CPE:
cpe:2.3:o:h3c:magic_nx15_firmware:*:*:*:*:*:*:*:*
The supplied records do not list any other affected versions.
Patch Status
The supplied sources do not report a vendor patch, fixed firmware version or advisory. The disclosure says only that "the vendor was contacted early." Because no KEV entry exists, CISA has set no required action or due date.
If you run Magic NX15 on NX15V100R017, check H3C directly for updated firmware. Until a fix is confirmed, limit network access to the device's management and RPC interfaces.