CVE-2026-36538: Netis AC1200 Router Auth Bypass Flaw

CVE-2026-36538 Overview

CVE-2026-36538 affects the Netis AC1200 Router NC21 running firmware version V4.0.1.4296. The device ships with a hard-coded root credential stored in /etc/shadow.sample. The root account uses the trivially weak password root. An attacker who can reach the device authentication interface can log in as root and gain full control of the underlying operating system. The flaw is classified under CWE-798: Use of Hard-coded Credentials.

Critical Impact
Successful authentication as root grants complete control of the router operating system, enabling traffic interception, persistent firmware backdoors, and lateral movement into connected networks.

Affected Products

Netis AC1200 Router NC21
Firmware version V4.0.1.4296
Configuration file /etc/shadow.sample shipped with the firmware image

Discovery Timeline

2026-05-27 - CVE-2026-36538 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-36538

Vulnerability Analysis

The Netis AC1200 NC21 firmware embeds a default password hash for the root account inside /etc/shadow.sample. The hashed value resolves to the cleartext string root. Because the credential is baked into the firmware image, every device shipped with this build shares the same root password. Owners cannot rotate the credential through normal configuration interfaces without modifying the underlying file system.

An attacker who reaches any authenticated service bound to the root account, such as Telnet, SSH, or a web administration shell, can submit root:root and obtain an interactive shell with full privileges. The vulnerability is reachable across the network, requires no prior privileges, and demands no user interaction.

Root Cause

The root cause is the inclusion of a static credential in firmware shipped to every customer. The shadow.sample template is copied or referenced during system initialization, leaving the device in a known-credential state. Hard-coded credentials [CWE-798] remove the assumption of secrecy that underpins password-based authentication.

Attack Vector

The attack vector is network-based against any management service that authenticates against the local Unix accounts. An attacker scans for exposed Netis NC21 devices, attempts the known root:root credential pair, and receives a privileged session on success. From this position the attacker can modify firewall rules, install persistence, sniff traffic crossing the router, and pivot into the LAN.

No verified public exploit code is available. The vulnerability mechanism is documented in the GitHub CVE-2026-36538 Disclosure.

Detection Methods for CVE-2026-36538

Indicators of Compromise

Successful root logins to the router from unexpected source IP addresses, particularly from WAN-side hosts.
Unexpected modifications to router configuration, DNS settings, or firewall rules after a remote session.
Presence of the default hash for root in /etc/shadow matching the value distributed in /etc/shadow.sample.
Outbound connections from the router to unknown command-and-control endpoints.

Detection Strategies

Inventory all Netis NC21 devices and confirm firmware version against V4.0.1.4296.
Attempt authentication with the known default credential in a controlled test to confirm exposure, then disable the account.
Review router authentication logs for repeated login attempts against the root account from external sources.

Monitoring Recommendations

Forward router syslog data to a central log platform and alert on root authentication events.
Monitor for configuration drift on managed routers using scheduled checksum comparisons of /etc/shadow and related files.
Watch network telemetry for unusual traffic patterns sourced from the router itself, which can indicate compromise.

How to Mitigate CVE-2026-36538

Immediate Actions Required

Block WAN-side access to all router management services, including Telnet, SSH, and the web administration interface.
Replace the root password on every affected device with a unique, high-entropy value where the firmware permits.
Segregate vulnerable routers behind an upstream firewall until a vendor patch is available.
Contact Netis support and monitor the Netis System Homepage for firmware updates that remove the hard-coded credential.

Patch Information

No vendor patch is referenced in the published advisory at the time of disclosure. Track the GitHub CVE-2026-36538 Disclosure and the Netis vendor site for updated firmware addressing CWE-798.

Workarounds

Disable remote administration features on the WAN interface in the router configuration.
Restrict LAN-side management access to a dedicated administrative VLAN or host.
Replace affected devices with hardware that does not ship with shared default credentials when a patch is not forthcoming.

bash

# Configuration example: restrict management access at the upstream firewall
# Drop inbound traffic to common router management ports from the internet
iptables -A FORWARD -i wan0 -p tcp -m multiport --dports 22,23,80,443 -d <router_ip> -j DROP