CVE-2026-15479: medium-severity vulnerability in H3C NX15
H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.5%
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
H3C · NX15public PoCs found — 1
cve_referencegithub.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/pre_auth_pwd_changeunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — H3C NX15
In the same product, most dangerous first.
CVE-2026-18902HIGHH3C NX15 esps repeaterproc command injectionEPSS 3.8%CVE-2026-18900HIGHH3C NX15 Backend RPC esps file.exec os command injectionEPSS 3.8%CVE-2026-18814HIGHH3C NX15 esps reload.reload_config command injectionEPSS 3.6%CVE-2026-18813HIGHH3C NX15 esps delete command injectionEPSS 3.6%CVE-2026-18812HIGHH3C NX15 esps esps.ipv6.wan command injectionEPSS 3.6%CVE-2026-18811HIGHH3C NX15 esps add command injectionEPSS 3.6%