CVE-2026-36540
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection in the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the OS shell without sanitization, allowing an attacker to achieve remote code execution.
Risk Assessment
An attacker on the LAN can gain full control over the router, modify its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.
Recommendation
Immediately update the router firmware to the latest available version or replace the device with a supported model. If no update is available, restrict management interface access to trusted hosts only.
Original NVD description (English source)
Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request.