CVE-2026-36539

Vulnerability

The Netis AC1200 Router NC21 running firmware version V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON response with no authentication required [1]. The response includes administrator credentials, WiFi passwords, PPPoE credentials, DDNS credentials, and a full map of all connected devices, all encoded in base64—which is trivially reversible [1]. No authentication token or header is needed to access this endpoint [1].

Exploitation

An attacker with LAN access (i.e., connected to the same network as the router) can send a single HTTP GET request to http:///cgi-bin/skk_get.cgi—for example, via a simple curl command or by navigating to the URL in a browser [1]. No prior knowledge, authentication, or user interaction is required [1]. The response is a JSON object; the attacker then decodes the base64-encoded values (e.g., using base64 -d on Linux) to retrieve plaintext secrets [1].

Impact

Successful exploitation results in full disclosure of the router's configuration, including the administrative password for the router's web interface, Wi-Fi pre-shared keys, PPPoE (ISP) credentials, DDNS account credentials, and a list of all LAN client IPs, MAC addresses, and hostnames [1]. An attacker can use the administrative credentials to take complete control of the router, change settings, or pivot deeper into the network, and can use the Wi-Fi and ISP credentials for unauthorized access or service abuse [1]. The confidentiality of all sensitive data managed by the device is completely compromised [1].

Mitigation

As of the publication date (2026-05-27), the vendor (Netis Systems) has not responded to disclosure attempts and no patch or firmware update has been released [1]. The device is likely end-of-life or unsupported [1]. Users should isolate the router from untrusted LAN clients by placing it behind a firewall or VLAN, or consider replacing the device with a supported alternative that receives security updates [1].