CVE-2026-18813

7.2 HIGHpublic exploit available

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The vulnerability allows command injection through manipulation of the 'esps.apcm.version' argument in the '/api/esps' endpoint, enabling remote code execution.
Exploitability: Exploitation is relatively straightforward given public disclosure and requires access to the affected H3C NX15 V100R017 system.
Blast radius: If exploited, this could lead to complete control of the affected device, potentially impacting network security and integrity.
Prioritized remediation: Apply vendor patches or disable the vulnerable '/api/esps' endpoint immediately.

rcewebremote-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-74, CWE-77

Public exploit & PoC references

https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/esps_apcm_version_delete_root_rce

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.