This vulnerability affects the Administrator Password Modification Endpoint in H3C NX15 V100R017. Specifically, the change_passwd function in the /api/login/modify API improperly handles the newPass argument, resulting in weak password recovery mechanisms. The flaw allows an unauthenticated remote attacker to manipulate password recovery, potentially compromising administrative access. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been confirmed by the vendor, and the exploit code has been made public.

An unauthenticated remote attacker can exploit this vulnerability to manipulate the password recovery process, potentially allowing unauthorized administrative access or password changes. This undermines the security of the affected device by weakening the protection of administrator credentials. The impact is rated medium severity based on the CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected API endpoint where possible and monitor for suspicious activity related to password modification attempts. Follow vendor communications closely for updates on patches or mitigations.