CVE-2026-18902

The argument name 'my2P4key' in the 'wan.repeater.set' endpoint is your most important diagnostic clue. The 'my' prefix and phonetic substitution ('2' for 'to', '4' for 'for') are hallmarks of prototyping code that shipped — developers use this convention when rapidly testing internally, intending to rename before release, then never do. If this is what happened with NX15 firmware, you're not looking at an isolated coding error. You're looking at evidence that H3C's development process has no gate between 'prototyping complete' and 'firmware shipped.' That matters because other non-standard argument names almost certainly exist in other NX15 API endpoints, each potentially representing additional command injection surface. Static analysis of other /api/esps* endpoints should be your immediate priority — if they share similar naming conventions, the authentication failure is likely systemic across the entire API layer, not isolated to this function. The 'wan.repeater.set' context places this at the network perimeter. A command injection here doesn't just give you the router — it gives you a transparent bridge position in the traffic path, effectively a man-in-the-middle position for every device downstream. The public Metasploit module changes the threat model: consumer NX15 deployments in SMB and residential environments rarely receive firmware updates within the first year of a CVE. The actual exposure window is measured in years, not weeks. Regardless of whether the underlying issue is a CLI-to-HTTP scaffold that never received authentication retrofit or a third-party web component with delegated access control, the structural failure is the same — this API layer was never designed to be exposed. Assume it's exploitable without credentials until proven otherwise, and prioritize network segmentation around any NX15 device at the WAN edge.

Reviewed through automated stages and approved by a human before publication.