CVE-2026-18902

H3C NX15 esps repeaterproc command injection

State: Published
Severity: 8.6 High
Published: Aug 5, 2026
Updated: Aug 5, 2026
Reserved: Aug 4, 2026

Description

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	7.2 High	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	8.3 High	AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
NX15H3C	V100R017Affected

References

VDB-385936 | H3C NX15 esps repeaterproc command injectionvdb-entrytechnical-description
VDB-385936 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-18902 | CVE Analysis and Reportthird-party-advisory
Submit #857833 | H3C NX15 Router NX15V100R017 Command Injectionthird-party-advisory
https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc/report/postauth_esps_wan_repeater_repeaterproc_rce_report.mdrelated
https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/esps.wan.repeater.set-repeaterproc/poc/postauth_esps_wan_repeater_repeaterproc_rce.pyexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.