CVE-2026-18814

7.2 HIGHpublic exploit available

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The vulnerability allows for command injection via the reload_config function in H3C NX15 V100R017, enabling remote code execution.
Exploitability: Exploitation is relatively easy given public exploits and requires access to the affected API endpoint.
Blast radius: If exploited, this could lead to full control over the device, potentially affecting network security and availability.
Prioritized remediation: Apply vendor patches immediately or disable the vulnerable API function until a patch is available.

rceapiremotepatch

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-74, CWE-77

Public exploit & PoC references

https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.