CVE-2026-15479 MEDIUM

CVE-2026-15479: H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery

Vendor H3C

Product NX15

Weakness CWE-640 · Weak password recovery

Published July 12, 2026

Last update July 12, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Key dates

02Disclosure timeline

July 12, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-15479 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/640.html AskarLabs — CWE-640 write-up Weak Password Recovery Mechanism for Forgotten Password

Related vulnerabilities

04Related CVE

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP CVE-2025-14783 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability CVE-2024-6125 Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism