Summary
H3C NX15 V100R017 contains a command injection vulnerability in the /api/esps file-deletion functionality. A remote attacker may manipulate the esps.apcm.version argument to influence operating-system command processing when the endpoint is reachable and input is not safely handled.
Affected context
The vulnerability occurs in H3C NX15 V100R017 deployments that expose the /api/esps functionality and process the esps.apcm.version argument through command-related operations. Risk depends on network reachability, request handling, and whether the affected service account has meaningful operating-system privileges.
Exploit preconditions
- Attack surface: Remotely reachable
/api/espsendpoint - Required access: Ability to send requests to the affected service; authentication requirements may depend on deployment configuration
- Trigger point: Processing of the
esps.apcm.versionargument during the file-deletion operation - Why exploitation is possible: Input may reach an operating-system command execution path without sufficient separation between data and command syntax
Why this happens
The underlying issue is improper neutralization of externally supplied input before it is used in an operating-system command context. If the application constructs or invokes commands using the esps.apcm.version value without strict validation and safe argument handling, attacker-controlled syntax may alter the intended command behavior. This maps primarily to CWE-77: Improper Neutralization of Special Elements used in a Command, with CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component describing the broader injection pattern.
Potential impact
- An attacker may execute unauthorized operating-system commands
- The affected device may be compromised or disrupted
- Device configuration or stored data could be altered
- Credentials, logs, or other sensitive information could be exposed
- A compromised device could support lateral movement into connected networks
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application workflows and reducing trust in request parameters.
Common defensive patterns include:
- Replacing command construction with direct, parameterized APIs
- Applying strict allowlist validation to version-related input
- Separating data values from executable command syntax
- Running the service with the minimum operating-system privileges required
- Restricting network access to the affected management endpoint
- Adding authorization and request-integrity controls around file operations
- Avoiding reliance on escaping alone as the primary defense
How teams detect issues like this
Detection can include:
- Static analysis for string concatenation or interpolation into shell and process-execution calls
- Code review checks for request parameters passed into file-system or command utilities
- Monitoring for unusual requests to
/api/esps, especially unexpected values inesps.apcm.version - Endpoint and device telemetry review for child processes or command activity initiated by the management service
- Policy enforcement requiring allowlist validation and parameterized process APIs
Automated code-review and application-security tools may help identify command construction patterns before deployment.
