H3C Magic NX15: Code injection via file write in RPC interface
Summary
A vulnerability in the RPC interface of the H3C Magic NX15 router (firmware NX15V100R017) allows code injection through the write function of the /api/esps endpoint. Because the path argument is not validated, an attacker can overwrite system plugins that run with root privileges, which can lead to full control of the device. According to the researcher's report, the attack requires an administrator session, and it can be carried out over the network. A public proof of concept exists and no vendor fix is confirmed.
Affected
- H3C Magic NX15, firmware NX15V100R017
- Other firmware branches: unknown
Fixed in
Unknown. No vendor advisory or fixed firmware version found.
Workaround
- Restrict access to /api/esps and the management web interface with firewall rules or network segmentation
- Disable remote administration if it is not needed
- Use a strong, unique admin password
Exploitation
- Public exploit disclosed; proof of concept available in the researcher's repository
- CISA SSVC: exploitation poc, not automatable
- No evidence of known exploitation in the wild
Our recommendation
- Inventory all H3C Magic NX15 devices and check for firmware NX15V100R017
- Remove WAN exposure of the management interface and block external access to /api/esps
- Rotate admin passwords and review admin accounts
- Monitor H3C advisories and firmware releases; track this CVE as no fix confirmed
- Ask the vendor for a firmware fix or replacement plan; consider replacing the device at critical sites
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Researcher repository: file_write_root_rce github.com
- VulDB CVE-2026-112371 vuldb.com
- VulDB vulnerability 422417 vuldb.com
- HOL CVE-2026-112371 hol.org
- Strix CVE-2026-112371 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:45.
Original description (NVD)
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.