This vulnerability affects the H3C NX15 device running version V100R017. The flaw exists in the esps.wan.repeater.set/repeaterproc function within the /api/esps endpoint, where manipulation of the my2P4key argument leads to command injection. This allows remote attackers to execute arbitrary commands on the affected device without user interaction. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. Although the exploit is public, there is no confirmed patch or official remediation from the vendor as of the published date.

Successful exploitation allows remote attackers with high privileges to execute arbitrary commands on the affected device, potentially leading to full system compromise. The vulnerability does not require user interaction and can be triggered remotely, increasing its risk. The public availability of exploit code further raises the threat level. However, no in-the-wild exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint and limit network exposure of the device to trusted sources only. Monitor vendor channels for updates and apply patches promptly once released.