CVE-2026-36540: Command Injection
Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skkset.cgi endpoint. The password and newpwdconfirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks () and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36540?
The severity of CVE-2026-36540 is high, with a CVSS score of 7.3.
What are the risks associated with CVE-2026-36540?
CVE-2026-36540 allows unauthenticated command injection, which can lead to complete control over the affected router.
How do I fix CVE-2026-36540?
To fix CVE-2026-36540, update the firmware of the Netis AC1200 Router NC21 to the latest version released by the vendor that addresses this vulnerability.
Who is affected by CVE-2026-36540?
CVE-2026-36540 specifically affects users of the Netis AC1200 Router NC21 running firmware version V4.0.1.4296.
What is the attack vector for CVE-2026-36540?
The attack vector for CVE-2026-36540 is through the /cgi-bin/skk_set.cgi endpoint, which allows unauthenticated users to send malicious command injection payloads.