# CVE-2026-112373: H3C Magic NX15 stack-based buffer overflow in usrlist

Source: https://junglewise.ai/threats/cve-2026-112373-a-security-vulnerability-has-been-detected-in-h3c-magic-nx15  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112373 · Severity: medium · CVSS 6.5 · Published 2026-10-20

H3C Magic NX15 is a network router used in enterprise environments. A stack-based buffer overflow in the usrlist daemon allows an authenticated attacker to trigger a denial-of-service condition by causing the router process to crash repeatedly. The vulnerability could potentially be exploited for more severe impact beyond denial of service.

Technologies: [H3C Magic NX15](https://junglewise.ai/threats/technologies/magic-nx15). Vendors: [H3C](https://junglewise.ai/threats/vendors/h3c).

## Quick answers

**Is CVE-2026-112373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112373 being exploited in the wild.

**How severe is CVE-2026-112373?** Medium severity, with a CVSS score of 6.5, published 20 October 2026.

**Which products and versions are affected?** H3C Magic NX15 NX15V100R017.

**Is there a fix for CVE-2026-112373?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112373 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112373?** Check whether you run H3C Magic NX15 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in sub_416874 of /usr/bin/usrlist, where data from /var/run/agentlist is accumulated into a 1024-byte stack buffer without bounds checking, using strcat(). An authenticated attacker can write oversized data via the /api/esps endpoint to trigger the overflow. The process is respawned by procd, creating a crash-restart loop; while denial of service is confirmed, the binary lacks stack protection and FORTIFY_SOURCE, suggesting potential for control-flow hijacking.

## Affected products

- H3C Magic NX15 NX15V100R017

## Timeline

- 2026-10-20: disclosed: Publicly disclosed with PoC

## References

- [https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_stack_overflow_dos](https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_stack_overflow_dos)
- [https://vuldb.com/cve/CVE-2026-112373](https://vuldb.com/cve/CVE-2026-112373)

## Related threats

- [H3C Magic NX15 path traversal in importprofile](https://junglewise.ai/threats/cve-2026-112372-a-weakness-has-been-identified-in-h3c-magic-nx15-v100r017-this)
- [H3C Magic NX15 code injection in /api/esps RPC interface](https://junglewise.ai/threats/cve-2026-112371-a-vulnerability-was-determined-in-h3c-magic-nx15-nx15v100r017)
- [H3C Magic NX15 os command injection in usrlist](https://junglewise.ai/threats/cve-2026-112370-a-vulnerability-was-found-in-h3c-magic-nx15-100r017-this-issue)
- [H3C Magic and NX series command injection in API](https://junglewise.ai/threats/cve-2025-29296-h3c-magic-and-nx-series-command-injection-in-api)