A critical command injection vulnerability in various H3C network devices allows unauthenticated remote attackers to achieve full system compromise.

This is a command injection flaw within the /api/esps request handler. The device fails to validate user-supplied parameters before passing them to system shell expressions, which enables an unauthenticated attacker to execute arbitrary commands as root.

With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation grants an attacker complete administrative control over the affected network device, potentially leading to unauthorized network access, data interception, and total system downtime.

Immediate Action: Review the H3C security advisory for available firmware updates and apply them to all affected devices immediately.

Proactive Monitoring: Monitor device logs for anomalous API requests directed at the /api/esps endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict network segmentation and restrict access to the management interfaces of these devices to trusted management subnets using a firewall.

Public Exploit Available: Yes — the vulnerability is confirmed to have public proof-of-concept material available.

Given the critical severity of this vulnerability and the availability of proof-of-concept code, administrators should prioritize patching these devices immediately. If an official patch is pending, restrict all external access to the management API to prevent remote exploitation.