Skip to content
Threat Feed
Subscribe

Vendor

H3C

5 briefs RSS
high advisory

Unauthenticated Access Vulnerability in H3C NX15

A missing authentication vulnerability in the H3C NX15 network device firmware (CVE-2026-18810) allows unauthenticated remote attackers to access the /api/wizard/networkSetup endpoint, potentially enabling unauthorized configuration changes.

PoC NX15 +1 cve-2026-18812 command-injection network-device cve-2026-18813 rce
4r 2t 7c 4i updated
high advisory

SQL Injection Vulnerability in H3C SecPath F1000-C8300 (CVE-2026-15907)

A SQL injection vulnerability, CVE-2026-15907, exists in H3C SecPath F1000-C8300 appliances up to version 20260522, allowing remote attackers to manipulate the 'subject' argument in the '/webui/?g=log_fw_nbc_mail_jsondata' endpoint to execute arbitrary SQL commands, potentially leading to unauthorized data access or system compromise, with a publicly available exploit.

SecPath F1000-C8300 sql-injection web-vulnerability h3c cve
1r 1t 1c 5i
high threat

H3C NX15 Weak Password Recovery Vulnerability (CVE-2026-15479)

A critical vulnerability, CVE-2026-15479, in H3C NX15 V100R017 allows remote attackers to perform weak password recovery by manipulating the 'newPass' argument in the '/api/login/modify' endpoint, leading to unauthorized administrator access.

exploited NX15 V100R017 vulnerability api-exploitation password-reset network-device remote-access
2t 1c 5i
critical advisory

H3C Magic B0 Buffer Overflow Vulnerability (CVE-2026-9393)

A buffer overflow vulnerability (CVE-2026-9393) exists in the Edit_BasicSSID_5G function of H3C Magic B0 devices up to version 100R002, allowing remote attackers to execute arbitrary code by manipulating the 'param' argument in the /goform/aspForm file.

Magic B0 buffer-overflow cve-2026-9393 h3c
2r 1t 1c
high threat

H3C Magic B3 Buffer Overflow Vulnerability (CVE-2026-8764)

A remote buffer overflow vulnerability exists in the UpdateWanParams function of the /goform/aspForm file in H3C Magic B3 devices up to version 100R002, which can be exploited by manipulating the 'param' argument, leading to potential remote code execution.

exploited Magic B3 buffer overflow remote code execution CVE-2026-8764
2r 2t 1c