CVE-2026-36539 Netis CVE debrief

Who should care

Network administrators managing Netis AC1200 NC21 deployments; security teams responsible for SOHO/consumer router security; incident responders investigating credential compromise on small office networks; CISOs evaluating supply chain risk from consumer networking equipment

Technical summary

The Netis AC1200 Router NC21 running firmware V4.0.1.4296 contains an unauthenticated information disclosure vulnerability in the `/cgi-bin/skk_get.cgi` CGI endpoint. This endpoint returns the complete router configuration as a JSON response without requiring authentication. An attacker with LAN access can issue a single HTTP GET request to this endpoint and obtain: administrator credentials, WiFi passwords, PPPoE credentials, DDNS credentials, and a complete enumeration of all connected devices. The vulnerability requires no authentication and no user interaction, presenting a critical risk for credential compromise and network reconnaissance. The attack vector is network-adjacent (LAN), with low attack complexity and high impact on confidentiality. No integrity or availability impact is described in the disclosure.

Defensive priority

critical

Recommended defensive actions

• Immediately restrict network access to the router's web management interface to trusted administrative hosts only; consider disabling remote management entirely
• Segment IoT and guest networks from administrative LAN segments to limit exposure of the router's management interface
• Monitor for unauthorized HTTP GET requests to `/cgi-bin/skk_get.cgi` in network logs as potential reconnaissance activity
• Apply firmware updates from Netis when available; contact vendor support for patch timeline if no update is published
• Rotate all credentials stored on affected routers including administrative passwords, WiFi PSKs, PPPoE credentials, and DDNS credentials after securing the device
• Conduct network forensics to identify if unauthorized configuration retrieval has occurred, reviewing logs for access to the vulnerable endpoint
• Replace affected hardware if vendor patches are not forthcoming, selecting routers with robust authentication requirements for configuration access

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Vendor attribution to 'Netis' for AC1200 Router NC21 is present in the CVE description, though the vendor field in source data is marked as 'Unknown Vendor' with review needed. The `/cgi-bin/skk_get.cgi` endpoint and unauthenticated configuration disclosure are explicitly documented in the CVE description. NVD status is 'Deferred' as of the modified timestamp.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.