CVE-2026-61517
HighCVSS 7.2Summary
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command with an incomplete denylist.
Risk Assessment
An authenticated administrator (or someone who obtains their credentials) can gain full control of the device, potentially compromising network security.
Recommendation
Upgrade Netis NX10 firmware to the latest version if a patch is available. Restrict access to the admin panel and use strong passwords.
Other vulnerabilities in Netis NX10
Original NVD description (English source)
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.