Vulnerability · Published Jul 12, 2026 · Assigned by VulDB

CVE-2026-15479H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery

High 7.3

In plain English

A high-severity security flaw in NX15 from H3C. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
H3C	NX15	V100R017

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-377785 | H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery vdb-entry, technical-description
VDB-377785 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-15479 | CVE Analysis and Report third-party-advisory
Submit #837069 | H3C NX15 V100R017 Incorrect Access Control third-party-advisory
https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/pre_auth_pwd_change exploit