CVE-2026-73673

Executive Summary

CVE-2026-73673 is an unauthenticated firmware update vulnerability in Netis NC63 router firmware V3.0.0.3327. It allows a network-adjacent attacker to upload unsigned firmware through the embedded Boa web server and the netis.cgi CGI dispatcher, bypassing both authentication and cryptographic signature verification. Successful exploitation results in persistent compromise of the router with high impact to confidentiality, integrity, and availability, as reflected by the CVSS score of 8.8.

Technical Analysis

The vulnerability is rooted in missing authentication enforcement for a critical function, classified as CWE-306. The Netis NC63 router firmware V3.0.0.3327 exposes a management web interface served by the Boa web server. The firmware update functionality is dispatched through the netis.cgi CGI handler and is reachable at the endpoint /cgi-bin/upload_fw.cgi.

Two distinct enforcement failures combine to create the vulnerability:

1. Web server authentication bypass: Boa grants access to any URI path containing the substring .cgi regardless of whether a valid session cookie is presented. This effectively bypasses the web server's authentication layer for all CGI paths, including the firmware upload handler.

2. CGI dispatcher authentication failure: The netis.cgi dispatcher reads the authentication state but does not enforce it before invoking the firmware update handler. As a result, an unauthenticated request can reach the firmware update code path.

The firmware update handler accepts uploaded images without requiring a cryptographic signature. Instead, image validation relies only on a forgeable additive checksum and static product strings. An attacker can craft a malicious firmware image, compute the expected checksum value, include the relevant Netis product identifiers, and submit the image via a multipart POST request to /cgi-bin/upload_fw.cgi without a session cookie. Because there is no authentication enforcement and no cryptographic trust chain, the request is processed and the malicious image can be written to the router's firmware storage.

The attack surface is the router's management interface over the network. The CVSS vector AV:A indicates that the attacker must be on an adjacent network segment, but exploitation requires no privileges, no user interaction, and no special conditions beyond being able to reach the Boa web service. The lack of a patch, combined with the ability to replace firmware, makes this a high-severity, persistent-compromise vector for affected Netis NC63 devices.

Exploitation Scenarios

1. Reconnaissance / Target Identification
An attacker on an adjacent network, such as a LAN or guest Wi-Fi segment, scans for Netis NC63 routers running firmware V3.0.0.3327. Indicators include Netis product strings in the web interface, a Boa web server banner, or the presence of CGI endpoints such as /cgi-bin/upload_fw.cgi. Since the management interface may be exposed to the local network, the attacker does not need to compromise another host first.

2. Triggering the Authentication Bypass
The attacker sends an HTTP POST request to /cgi-bin/upload_fw.cgi with Content-Type: multipart/form-data and no session cookie. Boa passes the request to the CGI dispatcher because the URI contains .cgi. The netis.cgi dispatcher reads the authentication state but does not enforce it before invoking the firmware update handler, so the request continues to the upload logic.

3. Payload / Execution Method
The attacker crafts a malicious firmware image. The image does not need a valid cryptographic signature; it only needs to pass the firmware update handler's weak validation, which is based on a forgeable additive checksum and static product strings. The forged image is uploaded as a multipart POST body. If accepted, the router's firmware update mechanism writes the image to non-volatile storage and may apply it on reboot.

4. Post-Exploitation Impact
Once the attacker-controlled firmware is active, the router is persistently compromised. The attacker can intercept and modify network traffic, redirect DNS and HTTP requests, harvest credentials, block or impair network availability, and use the router as a pivot point for lateral movement into the local network. Because the image is unsigned, standard software-level forensic recovery may not be possible; hardware reflashing may be required.

No public PoC is currently available, and the attack chain above is inferred from the NVD description and the vulnerability class. No specific exploit code, Nuclei template, or in-the-wild evidence has been confirmed.

Impact Assessment

The CVSS score is 8.8 out of 10 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The high confidentiality, integrity, and availability subscores reflect that a compromised router is a trusted network boundary device. An attacker who controls the router can read and modify traffic traversing the device, disrupt internet access, and maintain persistence across reboots.

Affected systems are Netis NC63 routers running firmware version 3.0.0.3327. The blast radius extends to all hosts on networks behind the affected router, including employee workstations, IoT devices, and other networked infrastructure. Because the vulnerability is unpatched, any vulnerable device remains at risk.

As of this report, CVE-2026-73673 is not listed in the CISA Known Exploited Vulnerabilities catalog, and there is no evidence of public exploit code. However, the technical weakness is straightforward to understand and weaponize, making this an attractive target for attackers who can gain adjacent network access.

Detection Guidance

The following detections are designed to identify unauthenticated attempts to access the Netis firmware upload endpoint. They should be tuned to the specific web server and log format of the deployment.

Sigma Rule

title: Netis NC63 Unauthenticated Firmware Upload Attempt
id: 5f9c0a7e-3c14-4b6c-9e8a-6f3d1a2b7c4d
status: experimental
description: >
  Detects HTTP POST requests to /cgi-bin/upload_fw.cgi, which the
  Netis NC63 firmware update handler uses. This endpoint is reachable
  without authentication due to the CVE-2026-73673 authentication bypass.
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    c-uri|contains: '/cgi-bin/upload_fw.cgi'
  condition: selection
level: critical
tags:
  - attack.t1190
  - cve.2026-73673
  - cwe.306

YARA Rule

rule CVE_2026_73673_Netis_Unsigned_Firmware_Upload {
    meta:
        author = "Valters IT SOC"
        description = "Detects HTTP captures containing an unauthenticated firmware upload to Netis NC63 /cgi-bin/upload_fw.cgi."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73673"
        cve = "2026-73673"
    strings:
        $http_post = "POST" ascii
        $upload_uri = "/cgi-bin/upload_fw.cgi" ascii
        $multipart = "multipart/form-data" ascii
        $product = "Netis" ascii nocase
    condition:
        all of them and filesize < 10MB
}

Suricata IDS Rule

alert http $HOME_NET any -> any any (msg:"CVE-2026-73673 Netis NC63 unauthenticated firmware upload attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/upload_fw.cgi"; http.request_body; content:"multipart/form-data"; classtype:attempted-admin; sid:2026736731; rev:1;)

Elastic Detection

any where event.dataset == "network_traffic.http" and http.request.method == "POST" and url.path == "/cgi-bin/upload_fw.cgi"

Splunk SPL Query

index=* sourcetype=access_combined cs_method=POST cs_uri_stem=/cgi-bin/upload_fw.cgi
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip dest_ip dest_port cs_uri_stem cs_method sc_status
| sort - count

Wazuh OSSEC Rule

<group name="web,">
  <rule id="100346" level="12">
    <decoded_as>web</decoded_as>
    <match>POST /cgi-bin/upload_fw.cgi</match>
    <description>Netis NC63 unauthenticated firmware upload attempt (CVE-2026-73673)</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4. No patch evidence has been found from any tracked source, and the vendor has not released a fixed firmware version for Netis NC63 V3.0.0.3327. No official workarounds are available.

1. Immediate Mitigations

• Restrict access to the router management web interface. Do not expose it to the internet or to untrusted network segments.
• Segment the network so that routers and other management devices are isolated from general user traffic.
• Use firewall rules to block external access to the CGI endpoint, particularly POST requests to /cgi-bin/upload_fw.cgi.
• Monitor local network traffic for POST requests to this endpoint and investigate any attempts immediately.

2. Patch / Upgrade Steps

• Apply an official firmware update as soon as the vendor publishes one. Validate the firmware image using a known-good cryptographic hash or signature before installation.
• If no patch is available, contact the vendor for a fixed version or remediation guidance.
• Before and after any firmware update, back up configuration data and document device settings to support recovery.

3. Long-Term Hardening

• Replace unsupported or unpatchable router hardware with devices that enforce signed firmware updates and mandatory authentication for management functions.
• Place network management interfaces behind a dedicated VPN and use strong, unique administrative credentials.
• Deploy network intrusion detection and logging at network boundaries to capture attempted exploitation of this vulnerability class.
• Regularly audit the firmware version and configuration of all edge and SOHO networking devices.

References

• NVD – CVE-2026-73673 Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-73673
• CVE.org – CVE-2026-73673 Record: https://www.cve.org/CVERecord?id=CVE-2026-73673
• MITRE – CWE-306 Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory was available for this vulnerability at the time of writing. No public exploit code, known threat actor campaign, or exploit-in-the-wild evidence has been identified, and the CISA KEV catalog does not list CVE-2026-73673.