H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H…

Multiple H3C network devices are affected by critical command injection vulnerabilities in the /api/esps request handler. Affected models include H3C Magic BE18000, NX400, Magic NX30 Pro, Magic R3010, Magic NX15, Magic R1510, and NE36 Pro. The vulnerabilities exist across several object interfaces and methods including esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, and esps.system.ntp. Attacker-controlled parameters are passed into shell expressions executed via eval without proper validation. A remote attacker can exploit these flaws to execute arbitrary commands as root, gaining complete control of the affected device. No authentication requirements are mentioned, making this a significant remote code execution risk for network infrastructure.