HIGH

CVE-2026-18902

2026-08-05 CVSS v3.1

CVSS

7.2

Description

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Weakness (CWE)

CWE-74 Injection

CWE-77 Command Injection

EPSS Score

2.38%

Probability of exploitation in next 30 days

83.2th percentile

References

https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc/poc/postauth_esps_wan_repeater_repeaterproc_rce.py https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc/report/postauth_esps_wan_repeater_repeaterproc_rce_report.md https://vuldb.com/cve/CVE-2026-18902 https://vuldb.com/submit/857833 https://vuldb.com/vuln/385936 https://vuldb.com/vuln/385936/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE