CVE-2026-36540

Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md
https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Netis AC1200 Router NC21 V4.0.1.4296 es vulnerable a inyección de comandos no autenticada a través del endpoint /cgi-bin/skk_set.cgi. Los parámetros POST password y new_pwd_confirm se pasan directamente al shell del sistema operativo subyacente sin sanitización. Un atacante puede inyectar comandos de shell arbitrarios envolviéndolos entre comillas invertidas (”) y codificándolos en base64. Debido a que el endpoint no requiere autenticación, cualquier dispositivo en la LAN puede lograr la ejecución remota de código completa en el sistema operativo del router con una única solicitud HTTP POST.

Information

Published : 2026-05-27 14:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-36540

Mitre link : CVE-2026-36540

CVE.ORG link : CVE-2026-36540

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-36540", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-36540", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T13:41:25.316769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-27T14:16:45.637", "references": [{"url": "https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md", "source": "cve@mitre.org"}, {"url": "https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request."}, {"lang": "es", "value": "Netis AC1200 Router NC21 V4.0.1.4296 es vulnerable a inyecci\u00f3n de comandos no autenticada a trav\u00e9s del endpoint /cgi-bin/skk_set.cgi. Los par\u00e1metros POST password y new_pwd_confirm se pasan directamente al shell del sistema operativo subyacente sin sanitizaci\u00f3n. Un atacante puede inyectar comandos de shell arbitrarios envolvi\u00e9ndolos entre comillas invertidas (\u201d) y codific\u00e1ndolos en base64. Debido a que el endpoint no requiere autenticaci\u00f3n, cualquier dispositivo en la LAN puede lograr la ejecuci\u00f3n remota de c\u00f3digo completa en el sistema operativo del router con una \u00fanica solicitud HTTP POST."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "cve@mitre.org"}