CVE-2026-18901

Executive Summary

CVE-2026-18901 is a high-severity vulnerability (CVSS 7.2) affecting the H3C NX15 router, model specifically in firmware V100R017. The flaw resides in the /api/esps endpoint of the Web API component, where the function service.add exposes a dangerous routine that can be triggered remotely. Successful exploitation allows an attacker to execute arbitrary operations with high-privilege context, leading to full confidentiality, integrity, and availability compromise of the device. Given that the device is a network gateway device, this poses significant risk to any organization using the H3C NX15 as a perimeter defense or network demarcation point. No patch is currently available, and the vulnerability has been publicly disclosed.

Technical Analysis

The H3C NX15 is a dual-band Wi-Fi 6 router commonly deployed in small-to-medium office environments and branch offices. The vulnerable component is the Web API service, which listens on the device's management interface (typically TCP port 80/443 or 8080 for management interfaces). The flaw is classified as CWE-749, Exposed Dangerous Method or Function.

Vulnerability Mechanism: The Web API endpoint /api/esps exposes the service.add function without adequate authentication or authorization checks. This function is designed to add new services to the router's service registry — a privileged operation intended only for administrative users. The exposed routine allows an unauthenticated or low-privileged remote attacker to invoke service.add directly, bypassing the intended access control layer.

The underlying issue is that the API handler for /api/esps does not validate the caller's session or role before dispatching to service.add. This is a classic case of an exposed dangerous function where the developer failed to enforce the principle of least privilege on a backend method. The API likely uses a generic RPC-style dispatcher that maps HTTP POST/GET parameters to internal method calls, and the service.add path was inadvertently included in the publicly reachable method table.

Attack Surface:

• The Web API service binds to both LAN and WAN interfaces depending on the configuration. In default configurations, management APIs may be restricted to LAN, but many deployments expose them for remote management.
• The endpoint accepts standard HTTP POST requests with JSON or form-encoded parameters.
• The service.add function accepts parameters that define a new service (name, port, protocol, target IP). An attacker can abuse this to create arbitrary port forwards or firewall rules, effectively establishing a tunnel into internal networks.

Technical specifics (code-level inference): The function service.add likely performs the following operations:

1. Parses service descriptor (name, protocol, port mappings).
2. Inserts the service into the iptables/nftables ruleset or the router's service table.
3. Applies the rule without re-authentication.

Capitalizing on this, an attacker can add a service entry that forwards external traffic on a chosen port to any internal host, achieving lateral movement capability and network pivoting.

Exploitation Scenarios

Attack Chain: Step-by-Step

1. Reconnaissance / Target Identification:

   • Attacker scans the internet for H3C NX15 devices using Shodan search terms such as product:"H3C NX15" or http.title:"H3C" and http.favicon.hash of the H3C login page.
   • Alternatively, internal attackers on the LAN identify the router management IP (typically 192.168.1.1 or 192.168.0.1) by scanning for open port 80/443/8080.

2. Trigger / Weaponization:

   • Attacker sends a crafted HTTP POST request to http://<target-ip>/api/esps on the management port.
   • The request body includes a JSON payload targeting service.add:

     POST /api/esps HTTP/1.1
     Host: 192.168.1.1
     Content-Type: application/json
     
     {
       "method": "service.add",
       "params": {
         "name": "backdoor_svc",
         "protocol": "tcp",
         "external_port": 4444,
         "internal_ip": "192.168.1.100",
         "internal_port": 22
       }
     }
     

   • The API handler dispatches this to service.add without verifying the requester's authentication token or admin role.

3. Payload / Execution:

   • The service.add function executes successfully, installing a new port-forwarding rule.
   • External traffic arriving at the router's WAN IP on port 4444 is now forwarded to internal host 192.168.1.100:22 (SSH).
   • If the router itself is targeted, the attacker can use service.add to create a rule that forwards the router's own management interface to an external reachable port, maintaining persistent access.

4. Post-Exploitation:

   • With an open port forward to an internal SSH service, the attacker pivots into the internal network.
   • If the attacker adds a service entry that points to the router's own LAN IP with a high port, they gain a stable backdoor that survives reboots (services are often persisted to config files).
   • The attacker can leverage this foothold to launch further attacks against internal hosts, exfiltrate data, or deploy ransomware.

Additional scenario: The attacker can abuse service.add to create a custom DNS or DHCP service entry, hijacking internal name resolution and performing man-in-the-middle attacks on internal traffic.

Impact Assessment

CVSS Breakdown (derived from vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H):

• Attack Vector: Network (remotely exploitable over the network).
• Attack Complexity: Low (no special conditions required).
• Privileges Required: High (the API requires some level of privilege, but the privilege boundary is improperly enforced — likely means an authenticated low-privilege user, or admin-level access is needed but the dangerous function is exposed beyond intended scope).
• User Interaction: None.
• Scope: Unchanged.
• Impact: High confidentiality, high integrity, high availability.

Business Impact:

• Confidentiality: Complete loss of network traffic confidentiality. An attacker can view, capture, and redirect all traffic passing through the router, extracting credentials, personal data, and proprietary business information.
• Integrity: Attackers can modify routing rules, DNS entries, firewall policies, and inject malicious content into traffic streams.
• Availability: The attacker can disable the router's services, create denial-of-service conditions, or brick the device by corrupting its configuration.

Affected Systems & Blast Radius:

• All H3C NX15 devices running firmware V100R017.
• Blast radius includes all devices and users behind the H3C NX15, which could be an entire branch office network, a home office, or a small enterprise segment.
• Given the router's placement at the network perimeter, the blast radius extends to the entire routed subnet.

CISA KEV Status: The vulnerability is NOT listed in CISA's Known Exploited Vulnerabilities catalog as of this report, but with a public exploit disclosure, this status may change rapidly.

Detection Guidance

Sigma Rule

title: H3C NX15 API Exposed Dangerous Routine - service.add
id: 8f6a2c94-9f2b-4b7e-8d3e-7f7f2a5b6c3d
status: experimental
description: Detects HTTP requests targeting the /api/esps endpoint of H3C NX15 router with service.add method, indicating exploitation of CVE-2026-18901.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18901
author: ValtersIT Threat Intel
date: 2026/02/18
logsource:
    category: webserver
    product: h3c
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/esps'
    selection_body:
        cs-body|contains|all:
            - 'service.add'
    condition: selection and selection_body
falsepositives:
    - Legitimate administrative API calls from authorized admins if the API does require authentication and the account is authorized.
level: high

YARA Rule

rule H3C_NX15_CVE_2026_18901_WebAPI_Exploit
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects HTTP payloads targeting H3C NX15 /api/esps endpoint with dangerous service.add routine"
        date = "2026-02-18"
        cve = "CVE-2026-18901"
        severity = "high"
    strings:
        $api_endpoint = "/api/esps" ascii wide nocase
        $method_service_add = "service.add" ascii wide nocase
        $method_name = "method" ascii wide nocase
        $json_param = "params" ascii wide nocase
    condition:
        uint16(0) == 0x3c21 and // '<!' or any
        filesize < 10KB and
        $api_endpoint and
        $method_service_add and
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT H3C NX15 /api/esps service.add Exploit Attempt (CVE-2026-18901)"; flow:established,to_server; content:"POST"; http_method; content:"/api/esps"; http_uri; content:"service.add"; http_client_body; nocase; classtype:attempted-admin; sid:202618901; rev:1; metadata:created_at 2026_02_18, updated_at 2026_02_18, cve CVE-2026-18901;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where event.category == "network_traffic" and destination.port in (80,443,8080) and
    network.protocol == "http" and http.request.method == "POST" ]
  [ http where event.category == "web" and url.path == "/api/esps" and
    http.request.body.content contains "service.add" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=httproot 
| where lower(method)="post" AND lower(uri_path)="/api/esps" 
| search body="*service.add*" 
| table _time, src_ip, dest_ip, dest_port, uri, body, user_agent
| eval exploitation_attempt = if(match(body, "service\.add"), "YES", "NO") 
| where exploitation_attempt == "YES"
| stats count by src_ip, dest_ip, dest_port

Wazuh OSSEC Rule

<group name="local,web,h3c,">
  <rule id="101901" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">/api/esps</field>
    <field name="method">POST</field>
    <description>H3C NX15 - Possible exploitation of exposed dangerous routine service.add (CVE-2026-18901)</description>
    <group>h3c_nx15_exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. There is no evidence of an official patch from H3C. The vendor was contacted early, but no fix has been published. Affected versions: H3C NX15 V100R017 (and potentially all V100Rxxx versions if the code base shares this API handler).

Immediate Mitigations (compensating controls):

1. Restrict Management Interface Access: Block external (WAN) access to the router's web management interface (ports 80, 443, 8080) at the upstream firewall. Only allow management from trusted LAN IPs.
2. Disable Remote Management: Access the H3C NX15 admin panel and disable WAN-side remote management. Set management access to LAN-only.
3. Change Default Credentials: Ensure the admin password is strong and unique. Though the vulnerability bypasses authentication, this prevents credential-based attacks that might chain with this flaw.
4. Segment the Network: Place the H3C NX15 behind a separate layer-3 firewall so that even if compromised, the attacker's access is limited to the router itself and not the internal network.
5. Monitor Logs: Enable and monitor router logs for any access to /api/esps or unexpected port-forwarding rule additions. Use the Sigma/YARA/Suricata rules above.

Patch/Upgrade Steps:

• Monitor H3C's official security advisories page (https://www.h3c.com/en/Support/Software_Downloads/) for an updated firmware version.
• When a patched firmware (V100R018 or later) is released, download it, verify its MD5/SHA256 checksum, and flash it via the admin panel.
• If no patch is forthcoming, plan to replace the device with a vendor that has a responsible disclosure and patching track record.

Long-Term Hardening:

• Network Segmentation: Segregate IoT/edge devices from production traffic.
• Least Privilege: Ensure any API-based management is restricted using multi-factor authentication (MFA) or at minimum IP whitelisting.
• Vendor Due Diligence: Evaluate H3C's patching cadence for edge devices before future purchases.
• Supply Chain Monitoring: Subscribe to CISA's Known Exploited Vulnerabilities catalog feed and NVD RSS feeds to get alerted if active exploitation emerges.
• Fallback Position: Given the unpatched status, consider temporary replacement of the H3C NX15 with an alternative router until a fix is publicly available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18901
2. H3C Official Portal (for future patch releases): https://www.h3c.com/en/Support/Software_Downloads/
3. CWE-749 — Exposed Dangerous Method or Function: https://cwe.mitre.org/data/definitions/749.html
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (verify ongoing status — not listed as of report date)
5. FIRST.org EPSS: https://www.first.org/epss/ (no score assigned yet)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: At the time of this report, there is no confirmed evidence of active exploitation in the wild. However, the public disclosure of the vulnerability details and the low attack complexity mean that opportunistic botnets (e.g., Mirai variants, Gafgyt) may adopt this within weeks. Organizations running this device should treat this as an active threat.