CVE-2026-61516

CriticalCVSS 9.8

Published: 08/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Summary

Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session.

Risk Assessment

An attacker could obtain the administrator password and log into the device, potentially leading to full control over the network device and traffic interception.

Recommendation

Upgrade Netis NX10 firmware to the latest version and restrict management interface access to trusted networks only.

Other vulnerabilities in Netis NX10

CVE-2026-61517High
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command with an incomplete denylist.

Original NVD description (English source)

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.