H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected interfaces and methods include esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, NX15 only), esps.swcm.version (delete, upgrade, all except NX15), and esps.system.ntp (set, all except NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing remote command execution as root and complete device compromise.

An attacker who successfully exploits these vulnerabilities can execute arbitrary commands with root privileges on affected devices, resulting in full control over the device. This can lead to unauthorized configuration changes, data compromise, and disruption of network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected management interfaces and monitor for suspicious activity targeting the /api/esps endpoint.