Skip to main content

​
Summary

The sysinfo action exposed through /web/cgi-bin/skk_get.cgi returns the Netis NX10 administrator password without requiring a session. The login handler accepts the disclosed stored value directly, allowing an unauthenticated attacker who can reach the management interface to establish an administrator session.
VulnCheck assigned this ID and stated that it will populate the CVE record after public disclosure. The public record was not yet available when this advisory was published.

​
Affected components

  • /web/cgi-bin/skk_get.cgi — exposes the unauthenticated sysinfo action
  • /web/cgi-bin/login.cgi — accepts the disclosed stored credential value

​
Technical details

The login page calls skk_get.cgi?sysinfo before authentication to obtain device state. The response contains the administrator password alongside the information needed by the page. The endpoint does not require a session cookie:
The response includes the sensitive value:
The value can be replayed directly to the login handler:
The cookie jar then contains an authenticated administrator session.

​
Impact

An unauthenticated attacker can obtain the router’s administrator credential and access every web-management function available to the administrator. This vulnerability also supplies the authentication prerequisite for CVE-2026-61517, turning the command-injection finding into an unauthenticated root-compromise chain. The interface is reachable from the LAN by default and may be WAN-accessible when remote management is enabled.

​
Remediation

The sysinfo response must never include passwords, hashes, session material, or other reusable credentials. Return only the minimum nonsensitive state required by the login page. Sensitive configuration endpoints should also require an authenticated and authorized session. Changing the administrator password alone is not sufficient because the endpoint would disclose the replacement value.

​
References

Last modified on September 8, 2026