A command injection vulnerability has been identified in H3C NX15 V100R017 networking equipment. The vulnerability resides in the Add function of the /api/esps endpoint, where manipulation of the esps.filter.url argument allows arbitrary command injection. The flaw can be exploited remotely without physical access to the device. A public exploit is already available, increasing the risk of active exploitation in the wild. The vendor was notified prior to public disclosure. This poses a significant risk to organizations using affected H3C NX15 devices, particularly given the IoT/network device context and public exploit availability.