CVE-2026-18901

CVE-2026-18901 in H3C NX15 firmware exposes a service.add function through the /api/esps endpoint without any authentication requirement, allowing unauthenticated attackers to create or modify system services. The CVSS 7.2 score correctly identifies the severity of this access control failure, but the underlying problem runs deeper than a missing auth decorator. The critical insight here is that this is a design-level vulnerability, not merely an implementation oversight. Even if authentication were added to this endpoint tomorrow, the function itself accepts arbitrary parameters to instantiate or modify system services—a capability that has no place in any network-facing API layer, authenticated or not. In the embedded Linux stacks common to H3C devices, the web daemon and system service manager typically share process space, meaning service.add exposes kernel-level primitives to a network interface that should never have that capability regardless of credential requirements. For defenders, the priority actions are: first, determine whether your NX15 deployment exposes the web interface to untrusted networks—these devices frequently ship in SMB and hospitality configurations with WAN-accessible management interfaces, which would make this immediately exploitable; second, if patching is unavailable, block all access to /api/esps at the network layer while recognizing this is a temporary measure; third, escalate to vendor support demanding not just an auth fix but a firmware version that removes service creation capabilities from the API surface entirely. The EPSS score of 0.00454 likely reflects scanner blind spots rather than genuine exploitation difficulty. Embedded device vulnerabilities with publicly available exploits tend to have poor honeypot coverage, but in configurations where the NX15 web API is externally accessible, treat this as actively exploitable rather than theoretical.

Reviewed through automated stages and approved by a human before publication.