Summary
ThepingHandler function in the Netis NX10 bin/netis.cgi binary interpolates the attacker-controlled IpAddr parameter into a shell command executed through system(). Its input filter blocks only space, pipe, semicolon, and ampersand characters. Other shell syntax remains available, allowing an authenticated administrator to execute arbitrary commands as root.
When chained with CVE-2026-61516, an attacker can obtain the required administrator session without credentials.
VulnCheck assigned this ID and stated that it will populate the CVE record after public disclosure. The public record was not yet available when this advisory was published.
Affected components
/web/cgi-bin/skk_set.cgi— dispatches thetools_setactionbin/netis.cgi— contains the vulnerablepingHandler
Technical details
Atools_set=1&type=1 request reaches the ping diagnostic. pingHandler reads the IpAddr parameter and rejects only these bytes:
The handler then constructs and executes a command equivalent to:
${IFS} supplies whitespace without containing a literal space.
Proof of concept
With an administrator session stored in./jar, the following request starts a root shell on TCP port 4444:
killall telnetd inside the shell after testing. Execution as UID 0 was confirmed through /proc/self/status on V4.0.1.5808.
Impact
Successful exploitation gives the attacker arbitrary command execution as root, allowing complete control of the router, its configuration, network services, and traffic. The attacker can install persistence, redirect DNS or routes, recover stored secrets, monitor traffic, and pivot toward other LAN systems. The command-injection issue requires an administrator session by itself. The separately assigned credential-disclosure vulnerability removes that prerequisite in affected deployments.Remediation
ValidateIpAddr as a structured IP address or hostname. Use inet_pton when only IPv4 or IPv6 addresses are required; otherwise enforce a strict hostname allowlist such as letters, digits, dots, and hyphens with appropriate length and label checks.
Do not pass user-controlled data through a shell. Invoke ping with an argument array through an execve-style interface. Expanding the current blocklist is insufficient because shells provide many alternative expansion and command-separation mechanisms.