CVE Feed

    Dashboard / CVE / CVE-2026-112372

    CVE-2026-112372

    A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

    Published:Oct 19, 2026
    Last Modified:Oct 20, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.00396
    CVSS Score:6.6

    Affected Products

    Vendor
    H3c
    Product
    Magic Nx15
    Vendor
    H3c
    Product
    Magic Nx15 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-112373 (CVSS 5.7) — A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_41687…
    CVE-2026-112371 (CVSS 8.6) — A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api…
    CVE-2026-112370 (CVSS 8.6) — A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /u…
    CVE-2025-29296 (CVSS 9.8) — H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Ma…
    CVE-2025-57295 (CVSS 8) — H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure defaul…
    CVE-2025-3546 (CVSS 8.6) — A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High