CVE-2026-18901 Overview
CVE-2026-18901 affects the H3C NX15 V100R017 router. The flaw resides in the service.add function of the /api/esps endpoint within the device's Web API component. Attackers can exploit an exposed dangerous routine [CWE-749] to execute unauthorized operations on the affected device. The attack is launched remotely over the network and requires authenticated access with high privileges. The exploit has been publicly disclosed, increasing the risk of opportunistic weaponization against exposed devices. The vendor was contacted before public disclosure.
Critical Impact
Successful exploitation of CVE-2026-18901 delivers full compromise of confidentiality, integrity, and availability on affected H3C NX15 V100R017 routers, with a publicly available proof-of-concept demonstrating a post-authentication root remote code execution chain.
Affected Products
- H3C NX15 router, firmware version V100R017
- Web API component (/api/esps endpoint)
- service.add function within the Web API
Discovery Timeline
- 2026-08-05 - CVE-2026-18901 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18901
Vulnerability Analysis
The vulnerability is classified as an exposed dangerous method or function [CWE-749]. The service.add routine exposed via /api/esps allows an authenticated actor to trigger functionality that should not be reachable through the Web API surface. According to the public report, the routine forms part of a root remote code execution chain on the NX15 device. Successful abuse results in arbitrary command execution with elevated privileges on the underlying router operating system.
Root Cause
The root cause is that the Web API exposes an internal service management routine (service.add) without adequate restriction on the operations it can perform. The function accepts caller-controlled parameters that flow into privileged service operations. Because the routine was not intended for arbitrary external invocation, its input handling and privilege boundaries are insufficient for an internet-facing management interface.
Attack Vector
An attacker with valid credentials sends a crafted HTTP request to /api/esps targeting the service.add method. The request payload manipulates the parameters passed into the service registration routine to escape its intended scope. The exploit chain culminates in command execution as root on the appliance. The attack is network-reachable and does not require user interaction. A proof-of-concept script (postauth_service_add_rce.py) demonstrating the full chain is available in the GitHub PoC Script and supporting GitHub Vulnerability Report.
Detection Methods for CVE-2026-18901
Indicators of Compromise
- HTTP POST requests to /api/esps referencing the service.add method from unexpected source addresses.
- New or unknown service entries appearing in the device configuration shortly after Web API activity.
- Outbound connections from the router to attacker-controlled infrastructure following administrative sessions.
- Presence of shell utilities, cron entries, or persistence artifacts on the router filesystem that were not deployed by administrators.
Detection Strategies
- Inspect Web API access logs for service.add invocations and correlate against authorized change windows.
- Alert on authenticated management sessions originating from geolocations or IP ranges outside approved administrator networks.
- Monitor router configuration diffs for unexpected service registrations that could indicate exploitation of /api/esps.
Monitoring Recommendations
- Forward router syslog and Web API audit events to a centralized SIEM for correlation with authentication activity.
- Track failed and successful logins against the H3C NX15 management interface to identify credential stuffing preceding exploitation.
- Baseline normal /api/esps usage and alert on deviations in request rate, parameter shape, or calling accounts.
How to Mitigate CVE-2026-18901
Immediate Actions Required
- Restrict access to the H3C NX15 Web API to a dedicated management VLAN and trusted administrator hosts only.
- Rotate all administrative credentials on affected devices, since exploitation requires authenticated access.
- Disable remote management on WAN interfaces until a vendor fix is applied.
- Review router configuration and service listings for unauthorized entries added through service.add.
Patch Information
No vendor advisory or fixed firmware version has been published in the referenced sources at the time of NVD publication on 2026-08-05. Monitor the VulDB CVE-2026-18901 entry and H3C's official security advisories for a patched V100R017 firmware release.
Workarounds
- Place the router management interface behind a VPN and block Web API access from untrusted networks at an upstream firewall.
- Enforce strong, unique credentials and multi-factor authentication for any account with access to /api/esps.
- Apply network ACLs that permit /api/esps traffic only from a small allowlist of administrator workstations.
# Example upstream ACL restricting NX15 Web API access to a jump host
# Replace addresses with values appropriate for your environment
access-list 150 permit tcp host 10.10.10.5 host 192.0.2.1 eq 443
access-list 150 deny tcp any host 192.0.2.1 eq 443 log
access-list 150 permit ip any any
interface GigabitEthernet0/0
ip access-group 150 in
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
