Key points
- H3C Magic NX15 firmware 100R017 contains a remote code execution vulnerability rated critical by NVD.
- The flaw involves OS command injection within the usrlist binary, specifically function sub_416874.
- Public exploit code exists for CVE-2026-112370, increasing the risk of automated attacks against unpatched systems.
Remote attackers can exploit a flaw in H3C Magic NX15 devices running firmware version 100R017. This capability stems from a vulnerability in the usrlist binary that allows operating system command injection. With exploit code already published, the risk of attacks is present for managed service providers overseeing these networks.
In plain English
The vulnerability allows an attacker to trick the system into running unintended commands. Instead of processing data safely, the software inserts attacker-controlled input directly into system instructions. This breaks the boundary between user input and system execution, granting control over the device. The source states remote exploitation is possible.
The background
The National Vulnerability Database lists CVE-2026-112370 with a CVSS score of 9.4, classifying it as critical. Another record rates it 8.6, high. Both cite CWE-78 and CWE-77 weaknesses. The issue resides in function sub_416874 of /usr/bin/usrlist. The vendor was contacted early regarding this disclosure.
What changes now
Organisations using H3C Magic NX15 must treat this as a risk. Since the exploit is public, scanning tools may target exposed devices. Until a vendor patch is released, teams should isolate affected systems or restrict access. Monitoring for unusual outbound traffic or new processes is essential to detect potential compromise attempts.
The attacker's path
Attackers typically exploit command injection to gain initial access without authentication. They send crafted inputs that the application processes as system commands. This technique bypasses application logic, granting direct operating system control. For intrusion teams, this serves as a foothold, allowing lateral movement or data exfiltration. Check whether inputs are sanitised and if execution boundaries are enforced strictly to prevent such abuse.
What to do and how to stay safe: H3C
- Audit all H3C Magic NX15 devices to confirm they are running firmware version 100R017.
- Restrict network access to these devices, limiting exposure to untrusted networks or the internet.
- Monitor logs for unexpected command execution or new processes initiated by the usrlist binary.
- Prepare an incident response plan to isolate compromised devices once the vendor provides an update.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch available for CVE-2026-112370?
No fix has been confirmed yet; the vendor was contacted early but no update is mentioned in the source material.
Which specific component is affected by this vulnerability?
The function sub_416874 within the /usr/bin/usrlist binary in H3C Magic NX15 firmware 100R017.
How severe is this vulnerability rated?
The NVD rates it as critical with a CVSS score of 9.4, though another record lists it as high at 8.6.
