CVE-2026-15479 | H3C NX15 V100R017 Administrator Password Modification Endpoint /api/login/modify change_passwd newPass password recovery

A vulnerability categorized as critical has been discovered in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery.

This vulnerability is cataloged as CVE-2026-15479. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure.