CVE-2026-18813

CVE-2026-18813 is a command injection vulnerability in the H3C NX15 router's `/api/esps` endpoint. The attack vector is straightforward: send a DELETE request with a JSON body containing a parameter like `esps.apcm.version` whose value gets passed directly to a shell `rm` command. The dot-notation naming convention is the forensic tell — it indicates the backend parsed the JSON and mapped the nested object directly into a shell invocation rather than using a safe configuration management API. This is not a one-off developer mistake; it's evidence of a development workflow that exposes shell-level commands through a public-facing API path. The CVSS 7.2 score doesn't capture the real risk. This is a network infrastructure device, not a web application. Compromising it gives an attacker a foothold on the network segment — traffic interception, DNS manipulation, and lateral movement to everything behind the router are all in play regardless of the EPSS probability score. The `/api/` prefix is itself a design failure: management functions should never share a network path with consumer-facing interfaces. What you should do: First, verify whether your H3C NX15 deployment has the management interface exposed to untrusted networks — it shouldn't be reachable from WAN or adjacent guest networks. Second, check whether your device is behind a properly segmented network boundary. Third, monitor for firmware updates, but treat any patch as potentially incomplete: if the fix only sanitizes `esps.apcm.version` rather than removing the underlying `system()` call pattern, sibling parameters like `esps.apcm.port` will remain exploitable. The vendor was contacted early, which suggests they had warning, but the deeper question is whether their engineering organization has the development abstractions to prevent this from recurring in the next firmware release — or whether they're managing this as an isolated incident with input validation that masks the architectural problem. Treat any network device with command injection as a critical-severity compromise regardless of CVSS, because the blast radius extends past the device itself.

Reviewed through automated stages and approved by a human before publication.