Netis NC63 Router up to 3.0.0.3327 Firmware Update /cgi-bin/upload_fw.cgi missing authentication

Summaryinfo

A vulnerability was found in Netis NC63 Router up to 3.0.0.3327. It has been declared as very critical. This affects an unknown part of the file /cgi-bin/upload_fw.cgi of the component Firmware Update Handler. The manipulation results in missing authentication. This vulnerability was named CVE-2026-73673. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Netis NC63 Router up to 3.0.0.3327. Affected is some unknown processing of the file /cgi-bin/upload_fw.cgi of the component Firmware Update Handler. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.

The advisory is available at netis-systems.com. This vulnerability is traded as CVE-2026-73673 since 08/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Netis

Name

• NC63 Router

Version

• 3.0.0.3327

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion