CVE-2026-15479 | A vulnerability was found in H3C NX15 V100R017. Affected by … | CVSS 7.3 HIGH

Description

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Metadata

CVE ID: CVE-2026-15479
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-11 09:56 UTC
Published: 2026-07-12 05:00 UTC
Last updated: 2026-07-12 05:00 UTC
Primary CWE: CWE-640
Weak Password Recovery
Vendor / Product: H3C / NX15
Sources: cve.org · NVD

Severity & Metrics

7.3 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
H3C	NX15	—	V100R017

Weakness (CWE)

CWE	Source	Description
CWE-640	cna	Weak Password Recovery

CVSS scores (4)

Score	Severity	Version	Source	Vector
7.5	N/D	2.0	cna	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
7.3	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
7.3	HIGH	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (5)

VDB-377785 | H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery https://vuldb.com/vuln/377785
VDB-377785 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/377785/cti
CVE-2026-15479 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15479
Submit #837069 | H3C NX15 V100R017 Incorrect Access Control https://vuldb.com/submit/837069
https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/pre_auth_pwd_change