CVE-2026-112370: H3C Magic NX15 usrlist sub_416874 os command injection

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-22
Weakness: CWE-77

Description

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Affected products

H3C Magic NX15: 100R017

References

https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce
https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce/poc
https://vuldb.com/cve/CVE-2026-112370
https://vuldb.com/submit/983537
https://vuldb.com/vuln/422416
https://vuldb.com/vuln/422416/cti

Get alerted when CVE-2026-112370 or the next vulnerability affects your stack