PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-36540 Netis CVE debrief

A critical unauthenticated command injection vulnerability affects Netis AC1200 Router firmware version NC21 V4.0.1.4296. The /cgi-bin/skk_set.cgi endpoint passes the password and new_pwd_confirm POST parameters directly to the underlying OS shell without sanitization, enabling arbitrary command execution via backtick-wrapped, base64-encoded payloads. The endpoint requires no authentication, allowing any LAN-connected device to achieve full remote code execution on the router's operating system with a single HTTP POST request.

Vendor
Netis
Product
AC1200 Router
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-05
Advisory published
2026-05-27
Advisory updated
2026-07-05

Who should care

Network administrators managing Netis AC1200 deployments, SOHO users with consumer-grade routers, security teams responsible for edge device hardening, and incident responders investigating router compromises.

Technical summary

The vulnerability exists in the /cgi-bin/skk_set.cgi endpoint of Netis AC1200 Router firmware NC21 V4.0.1.4296. The password and new_pwd_confirm parameters are passed unsanitized to the OS shell, enabling command injection through backtick-wrapped commands encoded in base64. No authentication is required to reach this endpoint, reducing the attack barrier to LAN network access only. Successful exploitation grants operating system-level code execution on the router.

Defensive priority

critical

Recommended defensive actions

  • Immediately isolate affected Netis AC1200 routers from untrusted LAN segments and restrict administrative interface access to dedicated management VLANs only.
  • Block outbound connections from router management interfaces to prevent callback channels from injected commands.
  • Apply firmware updates from Netis when available; consider replacement if vendor support has ended.
  • Monitor for anomalous HTTP POST requests to /cgi-bin/skk_set.cgi containing backtick characters or base64-encoded strings in password fields.
  • Review router logs for unexpected shell command execution or unauthorized configuration changes.

Evidence notes

CVE published 2026-05-27T14:16:45.637Z; modified 2026-05-27T20:04:31.980Z. NVD status: Deferred. Vendor attribution based on reference domain candidate 'Netis System' with low confidence requiring review. Disclosure documentation available via researcher GitHub repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-36540 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-36540

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-36540 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-36540

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.