CVE-2026-61516: Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.
Affected Software
Event History
Frequently Asked Questions
Which devices are known to be affected?
The affected firmware versions are Netis NX10 V4.0.1.5808 and V3.0.0.4142. The provided information does not establish whether other NX10 firmware versions are affected.
Does exploitation require credentials or user interaction?
No. An attacker can request the sysinfo action in the web management interface without a valid session, so no prior authentication or user interaction is required.
What can an attacker do with the disclosed password?
The exposed administrator password can be replayed to the login handler to create a fully authenticated administrator session. This can result in complete compromise of the device's confidentiality, integrity, and availability.