CVE-2026-61517— Netis NX10 OS Command Injection via Ping Diagnostic Handler
Quick assessment
Affected
Netis Systems NX10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netis NX10 固件版本 V4.0.1.5808 和 V3.0.0.4142 中的 ping 诊断处理程序存在操作系统命令注入漏洞。已认证的管理员可以通过向 参数注入内容，以 root 身份执行任意 shell 命令。该参数被直接插入到通过 执行的 shell 命令中，其不完整的拒绝列表仅阻止了空格、管道符、分号和 &（ampersand）符号，但仍留有命令替换和替代字段分隔符扩展的攻击面可供利用。
Possible ATT&CK Techniques 3 AI
T1015 T1059.004 · Unix Shell T1059 · Command and Scripting InterpreterAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Netis Systems | NX10 | 4.0.1.5808 |
affected |
3.0.0.4142 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61517
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netis NX10 OS Command Injection via Ping Diagnostic Handler
Source: CVE Program / CVE List V5
Vulnerability Description
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Netis Systems | NX10 | 4.0.1.5808 | - |
|
II. Public POCs for CVE-2026-61517
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61517
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-61517 (1)
Security Blog Posts for CVE-2026-61517 (2)
-
🔗 Netis NX10 Router: Two Vulnerabilities That Almost Felt Like a Backdoor - Hack with Mike Read full article technical-description exploit
-
Vendor Pages for CVE-2026-61517 (1)
IV. Related Vulnerabilities
Same vendor: Netis Systems
-
CVE-2026-61516
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endp -
CVE-2026-76071
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Pa -
CVE-2026-76070
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Passw -
CVE-2025-3759
Missing Authentication for Changing Device Configuration in -
CVE-2025-3758
Exposure of Device Configuration without Authentication in W
Same weakness: CWE-78
-
CVE-2026-87088
Tanium addressed an unauthorized code execution vulnerabilit -
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Co -
CVE-2026-82004
Adobe Campaign Classic (ACC) | Improper Neutralization of Sp -
CVE-2026-81349
Azure HDInsight Ambari Elevation of Privilege Vulnerability -
CVE-2026-86733
Snipe-IT before 8.7.0 Remote Code Execution via Backup Resto
V. Comments for CVE-2026-61517
No comments yet