CVE-2026-73673

{"id": "CVE-2026-73673", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73673", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T14:40:50.687314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Netis Systems Co., Ltd.", "product": "Netis NC63 Wireless AC1200 Router", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "V3.0.0.3327"}], "packageURL": "pkg:cargo/dua-cli", "defaultStatus": "affected"}]}], "published": "2026-08-14T13:19:09.573", "references": [{"url": "https://github.com/ozcanpng/CVE-2026-73673", "source": "disclosure@vulncheck.com"}, {"url": "https://ozcanpng.dev/blog/cve-2026-73673-netis-nc63-unauthenticated-firmware-update/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.netis-systems.com/products/NC63.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.netis-systems.com/support/downinfo.html?id=35", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/netis-nc63-unauthenticated-firmware-update-with-missing-cryptographic-firmware-authentication", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise."}, {"lang": "es", "value": "El firmware V3.0.0.3327 del router Netis NC63 contiene una vulnerabilidad de actualizaci\u00f3n de firmware no autenticada que permite a atacantes no autenticados enviar im\u00e1genes de firmware no firmadas explotando una falla de aplicaci\u00f3n de autenticaci\u00f3n faltante en el servidor web Boa y el despachador CGI netis.cgi. Los atacantes pueden enviar una solicitud POST multipart a /cgi-bin/upload_fw.cgi sin una cookie de sesi\u00f3n v\u00e1lida, eludiendo la autenticaci\u00f3n porque Boa otorga acceso a cualquier ruta que contenga \u2019.cgi\u2019 independientemente de la validaci\u00f3n de la cookie, y netis.cgi lee pero no aplica el estado de autenticaci\u00f3n antes de invocar el gestor de actualizaci\u00f3n de firmware, que acepta im\u00e1genes validadas solo por una suma de verificaci\u00f3n aditiva falsificable y cadenas de producto est\u00e1ticas en lugar de una firma criptogr\u00e1fica, lo que podr\u00eda permitir el compromiso persistente del router."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}