Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
A vulnerability exists in H3C Magic NX15 100R017 in the function sub_416874 of the file /usr/bin/usrlist that allows OS command injection through input manipulation.
An authenticated user with low privileges can remotely inject and execute arbitrary OS commands on the affected system, potentially compromising confidentiality, integrity, and availability across the network.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes, a patch is available as of October 20, 2026.
Apply the available patch immediately. Restrict network access to the affected H3C Magic NX15 device. Implement authentication controls to limit access to the /usr/bin/usrlist functionality. Monitor for suspicious command injection attempts targeting this service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-112370 . See article
NVD published the first details for CVE-2026-112370
A CVSS base score of 9.9 has been assigned.
GitHub Advisories released a security advisory .
Vulnerability Watch, October 20, 2026: 15 critical CVEs and 13 new vendor and CERT advisories
CVE Record: CVE-2026-112370
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
