This vulnerability exists in H3C NX15 V100R017 within the reload.reload_config function of the /api/esps file. It allows remote command injection, enabling an attacker to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity. Although the vendor was contacted early, no official fix or remediation details have been published. Public exploit code is available, but no confirmed active exploitation in the wild has been reported.

Successful exploitation can lead to remote command execution on the affected H3C NX15 device, potentially compromising the device's integrity and confidentiality. Given the high CVSS score and public availability of exploit code, the risk of attack is significant if the device is exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected API endpoint and limit network exposure of the device to trusted management networks only.