Description
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-385935 | H3C NX15 Web API esps service.add routine
https://vuldb.com/vuln/385935
Signature, Permissions Required signature
permissions-required
VDB-385935 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/385935/cti
Third Party Advisory third-party-advisory
CVE-2026-18901 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-18901
Third Party Advisory third-party-advisory
Submit #857817 | H3C NX15 Router NX15V100R017 Command Execution
https://vuldb.com/submit/857817
Scores
CVSS v3
7.2
EPSS
0.0045
EPSS Percentile
37.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-749
Status
published
Products (1)
H3C/NX15
V100R017
Published
Aug 05, 2026
Tracked Since
Aug 05, 2026