| Titre | netis NX10 V4.0.1.4139 Missing Authentication |
|---|
| Description | netis NX10 router firmware NX10-V4.0.1.4139 (CIS profile) exposes an unauthenticated configuration disclosure vulnerability in its web management server (Boa). The endpoint /cgi-bin/skk_get.cgi returns the entire device configuration in response to a single HTTP GET request, without requiring any authentication or session token.
Disclosed data includes:
- administrator password (base64-encoded)
- WPA2 pre-shared keys for all configured SSIDs (base64-encoded)
- TR-069/CWMP credentials and connection settings
- CSRF and session tokens (rid, rtoken)
- WAN IP address, port-forward rules, DHCP reservations, client lists
The corresponding write endpoint /cgi-bin/skk_set.cgi is properly session-protected (rejects unauthenticated requests with ["-1"]), indicating the read path was mistakenly exempted from the authentication gate.
Impact: Any device connected to the LAN, including a compromised IoT gadget or malware-infected host, can silently retrieve administrator credentials and all Wi-Fi keys, enabling full takeover of router administration (traffic redirection, DNS hijack, port-forward manipulation, firmware manipulation) and of the wireless network.
Reachability: The endpoint is accessible from the local network only. A multi-node external scan of the router's WAN address confirmed ports 22/80/443/9348/7547 closed from the Internet. WAN-side management is off by default.
Proof of Concept:
curl -s "http://192.168.1.1/cgi-bin/skk_get.cgi"
# HTTP/1.0 200 OK, ~37 KB text/JSON dump, e.g.:
# "password":"<base64-admin-password>"
# "wpaPsk":"<base64-wifi-key>"
# "rtoken":"<csrf-token>", "rid":"<session-id>"
# The write endpoint is protected:
curl -s "http://192.168.1.1/cgi-bin/skk_set.cgi"
# -> ["-1"] (rejected, no session)
Actual secret values redacted from public PoC.
Mitigation: No configuration-based fix exists in firmware V4.0.1.4139 (no management ACL; LAN web service cannot be disabled via UI). Until a fixed firmware exists, treat all credentials stored on the router as known to the entire LAN; isolate guest/IoT devices; monitor for LAN scanning behavior.
Vendor status: Notified 2026-08-09 via [email protected]. Vendor firmware-update infrastructure unreachable from CIS (update.cgi returns error_timeout; netis.com.cn times out; no download subdomains resolve).
CVE status: MITRE CNA-LR CVE ID request submitted 2026-08-09 - tracking number CAN-2026-2035413 (public CVE ID pending review). CVSS 3.1: 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-306 (primary), CWE-522, CWE-359.
Discoverer: Andrey Tretyakov ([email protected])
Disclosure: Coordinated - 90-day window from vendor notification (2026-08-09 to 2026-11-07).
|
|---|
| La source | ⚠️ https://gist.github.com/tretyakov-xrf/cf5af7a7a6dd8fee1027870aa1f6827a |
|---|
| Utilisateur | XRayFun (UID 100462) |
|---|
| Soumission | 09/08/2026 03:10 (il y a 2 mois) |
|---|
| Modérer | 29/09/2026 07:26 (2 months later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 399846 [Netis Systems NX10 3.0.0.4142/4.0.1.5808 Web Management Interface sysinfo divulgation d'information] |
|---|
| Points | 0 |
|---|