---
id: CVE-2026-112370
title: H3C Magic NX15 usrlist sub_416874 os command injection
summary: >-
  A vulnerability was found in H3C Magic NX15 100R017. This issue affects the
  function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation
  results in os command injection. Remote exploitation of the attack is
  possible. The e…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
vendor: H3C
product: Magic NX15
affected:
  - magic_nx15 100R017
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T22:15:15.054Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112370'
references:
  - url: 'https://vuldb.com/vuln/422416'
    label: VDB-422416 | H3C Magic NX15 usrlist sub_416874 os command injection
  - url: 'https://vuldb.com/vuln/422416/cti'
    label: 'VDB-422416 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112370'
    label: CVE-2026-112370 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/983537'
    label: 'Submit #983537 | H3C Magic NX15 NX15V100R017 OS Command Injection'
  - url: >-
      https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce
  - url: >-
      https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce/poc
tags:
  - cve.org
ingestedAt: '2026-10-19T22:46:42.321Z'
---

## Overview

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

## Affected

- `magic_nx15 100R017`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.