CVE-2026-36539: Netis AC1200 Router Info Disclosure Flaw

CVE-2026-36539 Overview

CVE-2026-36539 is an information disclosure vulnerability in the Netis AC1200 Router NC21 running firmware version V4.0.1.4296. The device exposes the CGI endpoint /cgi-bin/skk_get.cgi, which returns the complete router configuration as a JSON document without requiring authentication. An attacker on the local area network (LAN) can issue a single HTTP GET request to retrieve administrator credentials, WiFi passwords, PPPoE credentials, DDNS credentials, and a full inventory of connected devices. The flaw is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A single unauthenticated HTTP GET request returns administrator credentials, WiFi keys, PPPoE and DDNS secrets, and a map of all connected LAN devices.

Affected Products

Netis AC1200 Router NC21
Firmware version V4.0.1.4296
CGI handler /cgi-bin/skk_get.cgi

Discovery Timeline

2026-05-27 - CVE-2026-36539 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-36539

Vulnerability Analysis

The Netis AC1200 NC21 web management interface registers the skk_get.cgi handler under /cgi-bin/ and serves it without any authentication, session, or referer check. When the handler receives an HTTP GET request, it serializes the device's running configuration into a JSON object and returns it in the HTTP response body. The configuration includes plaintext or trivially reversible credentials for the administrator account, the wireless SSIDs, the ISP PPPoE session, and any configured DDNS providers. It also enumerates every host present in the DHCP lease table, exposing hostnames, MAC addresses, and assigned IP addresses.

Because the request requires no authentication header, cookie, or CSRF token, any client with network reachability to the router's LAN interface can retrieve the data. Exploitation needs only a single HTTP request and produces no visible artifacts in the user-facing administration console.

Root Cause

The handler lacks an authorization check before reading and returning configuration state. The router framework treats /cgi-bin/skk_get.cgi as a public diagnostic endpoint instead of placing it behind the same session validation used by the administrative web UI. Sensitive material is also stored in a form that can be returned verbatim rather than being redacted or hashed at rest.

Attack Vector

An attacker first gains LAN access through a wired port, an open or weakly secured WiFi network, or a compromised device on the network. The attacker then sends a single HTTP GET request to http://<router-ip>/cgi-bin/skk_get.cgi and parses the returned JSON. Recovered administrator credentials enable full takeover of the router, including DNS hijacking, firmware replacement, and pivoting to other internal hosts. The exposed PPPoE and DDNS credentials can be reused against upstream ISP and dynamic DNS accounts.

No verified proof-of-concept code is published in the enriched data. See the GitHub CVE-2026-36539 Disclosure for the original technical writeup.

Detection Methods for CVE-2026-36539

Indicators of Compromise

HTTP GET requests to /cgi-bin/skk_get.cgi originating from any LAN host other than the administrator workstation.
Unexpected administrator logins to the router web UI from internal IP addresses following a skk_get.cgi request.
Changes to DNS server settings, DDNS provider configuration, or WiFi credentials that were not initiated by an administrator.

Detection Strategies

Inspect router or upstream firewall logs for HTTP requests whose path contains skk_get.cgi.
Correlate access to the CGI endpoint with subsequent configuration changes recorded in the router system log.
Monitor DHCP and ARP tables for new or unauthorized devices that may be staging reconnaissance against the router.

Monitoring Recommendations

Enable verbose HTTP access logging on the router if supported and forward logs to a central collector.
Alert on any access to /cgi-bin/ paths from non-administrative source addresses.
Track outbound traffic from the router itself for anomalous DNS or DDNS update activity that may indicate credential reuse.

How to Mitigate CVE-2026-36539

Immediate Actions Required

Restrict access to the router management interface to a dedicated management VLAN or a single trusted host.
Rotate the administrator password, WiFi passphrases, PPPoE credentials, and DDNS credentials after isolating the device.
Disable WiFi guest networks and unused LAN ports until the device is patched or replaced.

Patch Information

No vendor advisory or fixed firmware version is listed in the enriched CVE data at the time of publication. Consult the GitHub CVE-2026-36539 Disclosure and the Netis support site for any subsequent firmware release that removes the unauthenticated skk_get.cgi handler.

Workarounds

Block inbound HTTP requests to /cgi-bin/skk_get.cgi at an upstream firewall or layer 7 filter where one is available.
Segment the router management network so that only authorized administrative endpoints can reach the router's web interface.
Replace the device with a model that exposes only authenticated management endpoints if no firmware fix becomes available.

bash

# Configuration example: block LAN access to the vulnerable CGI on an upstream Linux gateway
iptables -I FORWARD -p tcp -d <router-ip> --dport 80 \
  -m string --string "/cgi-bin/skk_get.cgi" --algo bm \
  -j DROP