This vulnerability involves an exposed dangerous routine in the service.add function of the /api/esps file within the Web API component of H3C NX15 V100R017. The flaw allows remote attackers to manipulate this routine, potentially leading to significant security impacts. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. Although the exploit has been publicly disclosed, there is no evidence of active exploitation in the wild. The vendor has been contacted but has not yet provided a remediation or patch.

Successful exploitation could lead to severe compromise of the affected system's confidentiality, integrity, and availability due to the exposed dangerous routine. The vulnerability is remotely exploitable without user interaction and with low complexity, making it a significant risk if left unaddressed. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published by the vendor, organizations should monitor vendor communications closely for updates. Until a patch is available, consider restricting access to the affected API endpoint and applying network-level controls to limit exposure.