CVE-2026-18902 Overview
CVE-2026-18902 is a command injection vulnerability in the H3C NX15 router running firmware V100R017. The flaw resides in the esps.wan.repeater.set/repeaterproc handler exposed through the /api/esps endpoint. An authenticated remote attacker can manipulate the my2P4key argument to inject arbitrary operating system commands. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public proof-of-concept exploit is available, increasing the risk of active exploitation against exposed devices.
Critical Impact
Successful exploitation allows a remote authenticated attacker to execute arbitrary commands on the H3C NX15 router, resulting in complete device compromise.
Affected Products
- H3C NX15 router
- Firmware version V100R017
- /api/esps endpoint exposing the esps.wan.repeater.set/repeaterproc function
Discovery Timeline
- 2026-08-05 - CVE-2026-18902 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18902
Vulnerability Analysis
The vulnerability affects the repeater configuration handler on the H3C NX15 router. The /api/esps endpoint routes requests to the esps.wan.repeater.set/repeaterproc function, which processes the my2P4key parameter without adequate neutralization of shell metacharacters. An attacker with valid credentials can supply crafted input to this parameter and cause the router to execute injected shell commands as part of internal system calls.
The attack is delivered over the network and requires no user interaction. Exploitation grants control equivalent to the process handling the request, which on embedded router platforms typically runs with elevated privileges. Publicly available proof-of-concept code, referenced in the GitHub PoC Script and the accompanying GitHub RCE Report, lowers the barrier to weaponization.
Root Cause
The root cause is insufficient input sanitization on the my2P4key argument. The value is passed into a downstream command execution context without escaping or allow-listing, permitting shell command separators such as ;, |, and backticks to break out of the intended argument.
Attack Vector
Exploitation requires network reachability to the router management interface and valid credentials (post-authentication). An attacker sends a crafted HTTP request to /api/esps invoking esps.wan.repeater.set/repeaterproc with a malicious my2P4key payload. See the VulDB CVE-2026-18902 entry for additional context.
The vulnerability is exploited through parameter manipulation rather than embedded sample code. Refer to the GitHub PoC Script for the technical request structure.
Detection Methods for CVE-2026-18902
Indicators of Compromise
- Unexpected HTTP POST requests to /api/esps invoking esps.wan.repeater.set/repeaterproc.
- my2P4key parameter values containing shell metacharacters such as ;, |, &, $(), or backticks.
- Unexplained outbound connections initiated from the router management plane.
- New or modified processes on the router that do not match the vendor baseline.
Detection Strategies
- Inspect HTTP traffic to the router management interface for anomalous payloads in my2P4key.
- Correlate authenticated management sessions with subsequent unusual outbound network activity from the router.
- Enable and centralize router syslog to identify configuration changes tied to repeater API calls.
Monitoring Recommendations
- Forward router logs to a centralized SIEM or data lake for retention and correlation.
- Alert on repeated failed and successful authentication attempts against the router web interface.
- Monitor for connections to the router administrative interface from unexpected source networks.
How to Mitigate CVE-2026-18902
Immediate Actions Required
- Restrict access to the router management interface to trusted management VLANs only.
- Disable remote WAN-side administration if enabled.
- Rotate all administrative credentials on affected H3C NX15 devices.
- Audit device logs for prior use of the esps.wan.repeater.set/repeaterproc endpoint.
Patch Information
No vendor patch reference is listed in the NVD record at the time of publication. According to the disclosure metadata, the vendor was contacted early about this disclosure. Administrators should consult H3C support channels for firmware updates superseding V100R017 and monitor the VulDB CVE-2026-18902 advisory for updated remediation guidance.
Workarounds
- Place the router management interface behind a firewall that permits access only from authorized administrative hosts.
- Enforce strong, unique credentials to reduce the risk of the required authenticated access being obtained.
- Where operationally possible, disable the WAN repeater feature until a vendor fix is available.
- Segment IoT and network infrastructure devices from user and server networks to contain post-exploitation activity.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
