Skip to content
Critical Command Injection Vulnerability in H3C Magic NX15 Disclosed

Critical Command Injection Vulnerability in H3C Magic NX15 Disclosed

First seen 20 Oct 2026, 13:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 15:19 UTC
  • •CVE-2026-112370 allows OS command injection in H3C Magic NX15 devices.
  • •The vulnerability has a CVSS score of 9.9, indicating critical severity.
  • •A patch was released on October 20, 2026; immediate application is advised.

A critical vulnerability, CVE-2026-112370, has been identified in the H3C Magic NX15 100R017, allowing OS command injection via the function sub_416874 in /usr/bin/usrlist. An authenticated user with low privileges can exploit this flaw to execute arbitrary OS commands remotely, compromising confidentiality, integrity, and availability. The CVSS score for this vulnerability is 9.9, indicating a critical severity. A patch has been released as of October 20, 2026, and users are urged to apply it immediately. There is currently no evidence of public proof-of-concept or confirmed exploitation in the wild. Security measures such as restricting network access and monitoring for suspicious activity are recommended.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-19
CVE-2026-112370 published
CVE-2026-112370 was officially published with a CVSS score of 9.4, indicating critical severity.
cve.report
2026-10-20
Patch released
A patch for CVE-2026-112370 was made available, and users are urged to apply it immediately.
Feedly

More articles in this cluster (5)

Following this threat?

Track H3C and CVE-2026-112370 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

What systems are affected?
The vulnerability affects the H3C Magic NX15 100R017 model.
What is the severity of this vulnerability?
The CVE-2026-112370 has a CVSS score of 9.9, indicating critical severity.
What actions should be taken immediately?
Apply the patch released on October 20, 2026, and restrict network access to the affected device.