CVE-2026-112360: Netis EAP930 CGI Endpoint debug return200 backdoor
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected product and version identified in the available information are Netis EAP930 1.250905.115454. No broader affected-version range is provided.
What does an attacker need to exploit this issue?
The attack can be initiated remotely against the CGI endpoint, using manipulation of the SIGNATURE argument in /cgi-bin/debug. It is rated high complexity and difficult to exploit; the provided severity vector also indicates high privileges are required.
Is a vendor fix available?
No vendor response or remediation is described. The vendor was contacted before disclosure but did not respond.
What can be checked to identify exposure?
Identify Netis EAP930 devices running version 1.250905.115454 and determine whether the /cgi-bin/debug CGI endpoint is reachable remotely. The available information does not provide indicators of compromise or a method to confirm exploitation.