This vulnerability affects the H3C NX15 device running version V100R017. The flaw exists in the Add function within the /api/esps endpoint. By manipulating the esps.filter.url parameter, an attacker can inject arbitrary commands remotely. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity. Although the vendor was contacted early, no official fix or mitigation has been disclosed. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows an attacker with high privileges to execute arbitrary commands remotely on the affected device. This can lead to full system compromise or disruption of device operations. The vulnerability does not require user interaction and has low attack complexity, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint and monitor for suspicious activity related to the esps.filter.url parameter. Follow vendor communications closely for updates on patches or official mitigations.