This vulnerability affects the H3C NX15 product version V100R017. The issue is located in the delete function of the /api/esps endpoint, where manipulation of the esps.apcm.version parameter leads to command injection. The vulnerability can be exploited remotely without user interaction and requires high privileges. The CVSS 4.0 base score is 8.6, indicating a high impact. The vendor was contacted early about the disclosure, but no patch or official remediation level has been published. Exploit code has been publicly disclosed, but no active exploitation in the wild is currently known.

Successful exploitation allows an attacker with high privileges to execute arbitrary commands remotely on the affected device, potentially leading to full system compromise. The vulnerability does not require user interaction and has high impact on confidentiality, integrity, and availability. However, exploitation requires high privileges, which limits the attack surface to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications closely. Restricting access to the affected API endpoint and limiting high-privilege user access may reduce exposure until a patch is available.