This command injection flaw in H3C NX15 firmware deserves more attention than its CVSS 7.2 rating and low EPSS score suggest — not because the scoring is wrong, but because it exposes a vulnerability archetype that automated tools systematically underweight.
The flaw lives in the IPv6 WAN management function, specifically through the workMode argument in what appears to be an operational API endpoint. This is not a web application vulnerability — it's infrastructure code running at network boundary privileges, likely handling router advertisements or serving as a default gateway. Compromising it doesn't give you one compromised host; it gives you the entire subnet the device manages, with persistence that survives reboots and often goes undetected because network infrastructure rarely gets inspected unless something fails visibly.
The EPSS score of 0.02261 is likely accurate for automated exploitation — but that's precisely the danger. The exploit is published, but it's not being fed into automated botnets because the attack requires manual targeting of a specific hardware fleet. This is the "mid-tier infrastructure CVE" pattern: automated scanners have moved on, but manual actors — particularly those with sustained access requirements — are still actively using it. The target set is devices that operators haven't patched, which for enterprise H3C deployments is most of them, because V100R017 is likely a firmware version that's no longer receiving active security updates.
H3C's SMB and consumer line has a documented vulnerability genotype — command injection in management API endpoints through operational arguments like workMode has appeared repeatedly in this product line. That predictability means defenders should treat this not as an isolated CVE but as evidence of a recurring family trait. If you have one NX15, assume others in the same fleet have similar exposure.
What to do: First, confirm whether your NX15 devices are running V100R017 or earlier firmware, and check whether H3C has released a newer version. Second, verify the patch actually removes the vulnerable code path — command injection flaws are sometimes gated behind authentication without fixing the underlying injection point, which means the vulnerability was bypassable to reach the injection in the first place. Third, treat any H3C management interface on WAN-facing IPv6 as higher-risk than the CVSS suggests, because the IPv6 monitoring gap means exploitation can persist longer than equivalent IPv4 vulnerabilities. The window between patch availability and enterprise deployment routinely stretches to quarters for network infrastructure — that's where the real exposure lives, not in the CVE feed.