H3C Magic NX15 firmware has four flaws, two rated 9.9

Four vulnerabilities in H3C Magic NX15 firmware V100R017 were published on 19–20 October 2026. CVE-2026-112370 (command injection in /usr/bin/usrlist) and CVE-2026-112371 (injection via /api/esps) score 9.9 under CVSS 3.1 and have public exploits. ZoomEye shows only 34,221 of 888,990 H3C assets answer on port 80.

• CVE-2026-112370 and CVE-2026-112371 score 9.9 under CVSS 3.1
• Both critical flaws have public exploits and need no credentials
• Only 34,221 of 888,990 H3C assets respond on port 80
• title="H3C Magic" returns 13,297 pages but cannot identify the NX15 model