HIGH

CVE-2026-18901

2026-08-05 CVSS v3.1

CVSS

7.2

Description

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Weakness (CWE)

CWE-749

EPSS Score

0.45%

Probability of exploitation in next 30 days

38.8th percentile

References

https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/service_add_root_rce_chain/poc/postauth_service_add_rce.py https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce_chain/report https://vuldb.com/cve/CVE-2026-18901 https://vuldb.com/submit/857817 https://vuldb.com/vuln/385935 https://vuldb.com/vuln/385935/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE