This is a command injection vulnerability in the H3C NX15 V100R017 SOHO router's web management interface. The Add function at /api/esps accepts an esps.filter.url parameter and passes it directly into a system command context without sanitization — a web API endpoint acting as a direct conduit to shell execution.
The CVSS 7.2 score reflects the severity: unauthenticated or weakly authenticated API access translates to root-level command execution on the device. The EPSS score of 0.02261 indicates moderate probability of active exploitation within 30 days, and a public exploit now exists, which shifts the threat from theoretical to operational.
What you should do:
First, confirm your firmware version. The NX15 V100R017 is the affected product line — check the admin interface or label for the exact version. If you're running an older firmware branch, H3C has released patches addressing this and similar injection points. Apply the update immediately.
Second, assume the web management interface is already compromised if you've exposed it to the internet. The management port (typically 80/443) should never be directly reachable from untrusted networks. Place the device behind a firewall that blocks external access to HTTP/HTTPS management ports, or disable remote management entirely if you only need local network administration.
Third, for devices that will not receive patches — and consumer networking hardware frequently reaches end-of-life without security updates — treat the vulnerability as permanent. Segment affected devices on isolated VLANs, monitor for indicators of compromise such as unexpected outbound connections or configuration changes, and plan for hardware replacement. The 'esps' API path suggests this is not an isolated function; audit for similar parameter-pass-through patterns in other API endpoints and report them to the vendor.
The deeper pattern here is command injection via web API parameters — a recurring vulnerability class in SOHO equipment where the web layer was architected as a thin wrapper around CLI functionality. This instance is not an anomaly but part of a well-documented genotype across multiple vendors. The presence of a public exploit means the window for proactive remediation is narrow.