Remote Command Injection in H3C Magic NX15 Router

CVE-2026-112370 is a critical command injection vulnerability affecting H3C Magic NX15 routers running firmware version 100R017. The vulnerability resides within the function sub_416874 inside the binary /usr/bin/usrlist. By sending specially crafted input to the targeted function, a remote, unauthenticated attacker can achieve arbitrary operating system command execution with the privileges of the underlying application. Public proof-of-concept exploits for this vulnerability are available, significantly increasing the risk of exploitation by threat actors. Due to the nature of the device as an internet-facing edge router, this flaw presents a high risk for unauthorized network access, lateral movement, or complete device compromise.

Impact

Successful exploitation allows for full remote compromise of the H3C Magic NX15 router. Attackers can gain persistent access, facilitate network reconnaissance, intercept traffic, or integrate the device into a botnet. This vulnerability is particularly dangerous for small office and home office (SOHO) deployments where these devices typically manage internet connectivity and local network segmentation.

Recommendation

Prioritize the identification and patching of all H3C Magic NX15 devices within the network environment. Since the vendor was contacted during the disclosure process, check for firmware updates beyond 100R017 that address CVE-2026-112370. Until firmware can be updated, restrict management interfaces of all networking hardware to internal, trusted management networks only, and disable remote administrative access from the public internet. Ensure that edge network traffic is inspected for anomalous command-injection patterns directed at router management endpoints.