CVE-2026-61517: Netis NX10 OS Command Injection via Ping Diagnostic Handler
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as an administrator on the affected device. Because exploitation is network-accessible and requires no user interaction, any party that can reach the management interface and obtain or use administrator credentials could exploit it.
Are both listed firmware branches affected?
The affected firmware versions identified are V4.0.1.5808 and V3.0.0.4142. The provided information does not establish whether earlier, later, or other firmware versions are affected.
What level of access does successful exploitation provide?
Successful exploitation allows arbitrary shell command execution as root. This can result in complete compromise of the device's confidentiality, integrity, and availability.
What input is involved in exploitation?
The vulnerable input is the IpAddr parameter of the ping diagnostic handler. Its filtering blocks spaces, pipes, semicolons, and ampersands, but does not prevent command substitution or alternate field-separator expansion.