A command injection vulnerability has been identified in H3C NX15 V100R017 firmware. The flaw exists in the reload.reload_config function within the /api/esps endpoint. Remote attackers can exploit this vulnerability without authentication to execute arbitrary commands on the affected device. A public exploit has been released, increasing the risk of active exploitation. The vulnerability was responsibly disclosed to the vendor prior to public release. This affects IoT/networking hardware from H3C, a prominent network equipment manufacturer. The availability of a public proof-of-concept significantly elevates the threat level for unpatched devices.