H3C Magic NX15: OS command injection in usrlist daemon
Summary
The usrlist daemon on H3C Magic NX15 routers with firmware 100R017 builds a shell command from lines in /var/run/agentlist without escaping them. An authenticated attacker can insert a double quote to inject arbitrary OS commands, which run with root privileges. The file can be written through the /api/esps file.write method, and the daemon re-reads it every second, so the injected commands run automatically. A public proof of concept exists.
Affected
- H3C Magic NX15, firmware 100R017 (VulDB: NX15V100R017)
- Component: /usr/bin/usrlist, function sub_416874
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor fix has been published in the sources reviewed.
Workaround
Unknown. No vendor workaround is documented.
Exploitation
- Public proof of concept: yes.
- Exploited in the wild: no evidence found.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation PoC, automatable no, technical impact total.
Our recommendation
- Inventory all H3C Magic NX15 devices and their firmware versions.
- Remove WAN access to the management interface and restrict it to admin networks by IP.
- Limit the number of accounts with login access and change default or weak passwords.
- Ask H3C or your distributor for a fix timeline and firmware newer than 100R017.
- Review logs and configurations of devices that were exposed while unpatched.
- Re-check NVD and the H3C support portal weekly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Research report and PoC repository (usrlist_cmdi_root_rce) github.com
- Proof of concept (usrlist_cmdi_root_rce/poc) github.com
- VulDB CVE-2026-112370 vuldb.com
- VulDB entry 422416 vuldb.com
- OpenCVE CVE-2026-112370 app.opencve.io
- HOL Guard CVE-2026-112370 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:45.
Original description (NVD)
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
NVD references (6)
- https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce
- https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce/poc
- https://vuldb.com/cve/CVE-2026-112370
- https://vuldb.com/submit/983537
- https://vuldb.com/vuln/422416
- https://vuldb.com/vuln/422416/cti
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.