H3C Magic NX15 OS Command Injection in usrlist Binary Enables Remote Code Execution With Public Exploit

H3C Magic NX15 devices running firmware version 100R017 are vulnerable to remote command injection. Security researchers have disclosed that a public exploit targets this flaw, allowing attackers to execute arbitrary operating system commands on affected systems.

What happened

The National Vulnerability Database lists CVE-2026-112370 as affecting H3C Magic NX15 100R017. The vulnerability resides in the sub_416874 function within the /usr/bin/usrlist file. According to the record, manipulating this function results in OS command injection. This means an attacker can inject malicious commands into the system process.

The flaw has been assigned a CVSS score of 9.4, which is rated as critical. Another record lists the same CVE with a score of 8.6, rated as high. Both ratings confirm the severity of the remote exploitation risk. The weaknesses are categorized under CWE-78 and CWE-77, which relate to improper neutralization of special elements.

The exploit code for this vulnerability has been made public. This increases the likelihood of automated scanning and active exploitation in the wild. The vendor was contacted early about this disclosure, according to the NVD record. No patch or fix has been confirmed yet in the provided material.

Why it matters

Remote command injection allows attackers to take full control of the device. Once executed, the attacker can run any command the system user has permission to execute. This can lead to data theft, system compromise, or lateral movement within a network. The public availability of the exploit lowers the barrier for malicious actors.

Organizations using H3C Magic NX15 devices must assess their exposure. If devices are exposed to untrusted networks, the risk is significantly higher. The lack of a confirmed fix means immediate mitigation steps are necessary. Security teams should prioritize identifying all instances of the affected firmware version.

What to watch

• Check for unusual outbound traffic from H3C devices.
• Monitor logs for unexpected command executions on /usr/bin/usrlist.
• Look for new processes spawned by the usrlist binary.
• Verify if any devices are running firmware version 100R017.

Signals worth monitoring

Security teams usually observe anomalous process creation when command injection occurs. Check whether the usrlist binary spawns child processes that do not match normal operational patterns. Look for outbound connections to unknown IP addresses from the affected device. Monitor authentication logs for new user accounts or privilege escalations. Containment moves typically involve isolating the compromised device from the network. Disable remote management interfaces if possible. Review firewall rules to block unauthorized traffic. Ensure logging is enabled to capture forensic evidence for later analysis.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: H3C

• Inventory all H3C Magic NX15 devices and verify firmware versions.
• Restrict network access to these devices from untrusted sources.
• Monitor system logs for signs of command injection activity.
• Prepare to isolate affected devices once the vendor provides an update.

Step-by-step guide: Detect Lateral Movement: Log Signals, Blind Spots and Detection Logic

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which firmware version is affected by CVE-2026-112370?

H3C Magic NX15 firmware version 100R017 is affected by this vulnerability.

Is there a public exploit for this flaw?

Yes, the exploit has been made public and could be used by attackers.

What is the CVSS score for CVE-2026-112370?

The CVSS score is 9.4, which is rated as critical, though another record lists it as 8.6 high.