H3C Magic NX15 routers hit by two CVSS 9.9 command injection flaws with public exploits

Four flaws, two rated critical

Four vulnerabilities in H3C's Magic NX15 router, all affecting firmware V100R017, were published on 19 and 20 October 2026. According to a dev.to analysis of the disclosure, two of them are rated 9.9 under CVSS 3.1. CVE-2026-112370 is an OS command injection in the function sub_416874 inside /usr/bin/usrlist, while CVE-2026-112371 is a command injection reachable through the /api/esps endpoint of the device's RPC interface. Exploit code for both is public, the analysis notes, and H3C was contacted before the flaws were disclosed.

Both of the top-rated issues are reached through the router's web interface and, per the analysis, require no credentials. Whether any given device is actually at risk therefore comes down to one thing: whether that web interface can be reached by an attacker.

Sizing the exposed population

To estimate how many devices might be affected, the analysis queried the ZoomEye search engine on 27 October 2026. A vendor-wide fingerprint for H3C matched 888,990 assets, but only 34,221 of those — under four percent — answered on port 80.

The gap reflects H3C's product mix. The company sells mostly enterprise and carrier switches, routers and access points, equipment that tends to expose SNMP, SSH, Telnet and vendor-specific management protocols rather than a web server on the standard HTTP port. Since the two critical flaws are HTTP-path issues, the analysis argues the 34,221 web-reachable devices form the practical upper bound on exposure, while the 888,990 total describes equipment these vulnerabilities cannot touch.

No way to count the model itself

None of the scan data isolates the NX15, and no field reports firmware version, so the number of affected routers cannot be derived from public measurements. The nearest proxy is a page-title search for "H3C Magic", H3C's consumer line, which returned 13,297 results. That figure is a starting list rather than an answer: the Magic family spans many models that share a web interface, and an application fingerprint for the line returns nothing at all. Confirming real exposure still requires checking each host for its exact model and firmware.

When query results don't add up

The analysis also documents a puzzle in the measurement itself. A title search for "H3C" returned 29,452 pages, and the vendor fingerprint combined with port 80 returned 34,221, yet combining the title search with port 80 yielded just 889 results. The suggested explanation is that many of these web interfaces listen on non-standard ports such as 8080, which is common on carrier and enterprise gear, and that title-based queries don't record the port a page was actually served from. The takeaway for anyone measuring exposure: fields on the same asset record don't necessarily combine the way they appear to, and one extra condition cut this population by 97 percent even though each individual count looks correct.

Why it matters

Two unauthenticated command injection flaws with public exploit code in a consumer router are dangerous in themselves, but the scan data reframes what exposure actually means. The headline vendor count is largely irrelevant; what decides risk is whether a router's administration interface answers from the internet. A Magic router with its web interface exposed through port forwarding is in danger regardless of which model its page title names, while one sitting behind NAT with nothing forwarded is not. The same logic scales up: thousands of web-reachable management interfaces on H3C enterprise gear are a reminder that HTTP management planes are widespread enough to inventory and lock down. NX15 owners should check with H3C for a firmware update and make sure the device's web interface is not reachable from outside the home network.