Key points
- CVE-2026-112370 allows remote OS command injection in H3C Magic NX15 100R017.
- The flaw affects the /usr/bin/usrlist file and function sub_416874.
- Public exploit code exists, increasing the risk of widespread automated attacks.
Administrators managing H3C Magic NX15 devices running firmware version 100R017 must address a severe security flaw immediately. The vulnerability, tracked as CVE-2026-112370, permits remote attackers to inject operating system commands. Security databases rate the issue as critical with a CVSS score of 9.4, indicating a high potential for damage. The National Vulnerability Database also lists a secondary rating of 8.6, categorized as high severity. Both ratings confirm the serious nature of the remote exploitation risk.
In plain English
The bug exists in a specific system file called /usr/bin/usrlist. Within this file, a function named sub_416874 fails to properly sanitize input data. An attacker can manipulate this input to trick the system into executing arbitrary commands. Because the flaw allows remote exploitation, attackers do not need physical access to the device. They can trigger the injection from outside the local network, potentially taking full control of the affected H3C Magic NX15 hardware.
The background
Researchers identified this weakness, which maps to CWE-78 and CWE-77, common categories for command injection flaws. The vendor was contacted early in the disclosure process regarding the vulnerability. Crucially, exploit code for CVE-2026-112370 has been made public. This availability means that automated scanning tools and malicious actors can easily identify and target systems running the vulnerable firmware version 100R017 without needing to develop custom attack methods.
What changes now
Organizations must verify if any H3C Magic NX15 devices are still on version 100R017. The presence of public exploit code significantly raises the urgency of remediation efforts. Since no patch or updated firmware version is mentioned in the current records, teams must monitor vendor communications closely for a confirmed fix. Until an official update is released, the exposure remains active and unmitigated by software changes.
Who needs to act first
Teams should prioritize isolating exposed H3C Magic NX15 devices from untrusted networks immediately. Check whether these systems handle sensitive data or face direct internet exposure. If possible, restrict access to the devices using strict firewall rules that block unnecessary inbound traffic. Back up current configurations carefully before making any changes. Monitor logs for unusual command execution patterns that might indicate an active attack. Coordinate with security vendors to ensure detection signatures are updated.
Background: Firewall rules
The difference between acl and firewall rules lies in their operational depth and memory usage. Access control lists evaluate packets statically based on source and destination addresses, while firewalls inspect connection states, transport protocols, and application context to make dynamic filtering decisions.
Read the full guide: Difference between acl and firewall rules explained clearly
What to do and how to stay safe: H3C
- Inventory all H3C Magic NX15 devices to confirm their firmware versions.
- Restrict network access to vulnerable systems until a patch is available.
- Monitor system logs for signs of unauthorized command execution.
- Watch vendor announcements for the release of a security update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific product and version is affected by CVE-2026-112370?
The vulnerability affects H3C Magic NX15 devices running firmware version 100R017.
Is there a patch available to fix this vulnerability?
No fix has been confirmed yet in the provided source material.
Can this vulnerability be exploited remotely?
Yes, remote exploitation of the attack is possible according to the NVD record.
