Patch H3C Magic NX15 Firmware to Block Critical RPC Code Injection and Protect Networks

Remote attackers can inject arbitrary code into H3C Magic NX15 devices running version NX15V100R017. This capability allows unauthorized users to execute code on the device without needing prior access. The National Vulnerability Database rates the flaw as critical, signaling immediate risk to any organization using this specific firmware version.

The vulnerability, tracked as CVE-2026-112371, stems from improper handling of input within the Remote Procedure Call interface. Specifically, the write function in the /api/esps file fails to sanitize the path argument. According to the NVD record, manipulating this argument leads directly to code injection. Because the attack vector is remote, attackers can exploit the weakness from outside the local network.

Context and Background

The National Vulnerability Database lists two severity scores for CVE-2026-112371: 9.4 (Critical) and 8.6 (High). Both ratings reflect the ease of exploitation and the severity of the impact. The Common Weakness Enumeration identifies the root issues as CWE-94 and CWE-74, which relate to code injection and improper control flow during execution. The vendor was contacted early regarding the disclosure, but the exploit has since been publicly released and may be utilized.

Affected Systems

Only H3C Magic NX15 devices running firmware version NX15V100R017 are confirmed to be affected by this specific code injection flaw. Small-business owners who have deployed this hardware for network management should verify their current firmware version immediately. If the device is running NX15V100R017, it is vulnerable to remote attacks that can compromise the system. Other H3C products or different firmware versions are not mentioned in the current advisory.

What to watch

Monitor vendor communications for an official security patch or firmware update addressing CVE-2026-112371. Until a fix is confirmed, watch for unusual network traffic or unexpected command execution on affected devices. Security teams should also scan external logs for connection attempts targeting the RPC interface. Public availability of the exploit code increases the likelihood of automated scanning and targeted attacks against exposed systems.

What made it possible

Remote code injection vulnerabilities typically arise when applications process untrusted input without adequate validation. Attackers exploit this by inserting malicious commands into expected data fields, such as file paths or configuration arguments. This technique serves as an initial access vector, allowing adversaries to bypass authentication and gain command-line control.

Teams usually see this class of flaw in APIs that interact with system functions. Check whether your infrastructure relies on services that accept user-supplied inputs for file operations or command execution. Ensure that all external-facing interfaces enforce strict input filtering and type checking to prevent unexpected code from running on host systems.

What to do and how to stay safe: H3C

• Verify the firmware version on all H3C Magic NX15 devices to confirm if NX15V100R017 is installed.
• Isolate affected devices from the public internet using firewall rules if they cannot be updated immediately.
• Monitor network logs for suspicious activity targeting the RPC interface or the /api/esps endpoint.
• Contact H3C support to inquire about the status of a security patch for CVE-2026-112371.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which H3C devices are affected by CVE-2026-112371?

Only H3C Magic NX15 devices running firmware version NX15V100R017 are confirmed to be vulnerable.

Is there a patch available for this vulnerability?

No fix has been confirmed yet; the vendor was contacted early, but no update is listed as released.

How serious is this code injection flaw?

The National Vulnerability Database rates it as critical with a CVSS score of 9.4 and high at 8.6.