CVE-2026-36540: Netis AC1200 Router RCE Vulnerability

CVE-2026-36540 Overview

CVE-2026-36540 is an unauthenticated command injection vulnerability in the Netis AC1200 Router NC21 firmware version V4.0.1.4296. The flaw exists in the /cgi-bin/skk_set.cgi endpoint, which passes the password and new_pwd_confirm POST parameters directly to the underlying operating system shell without sanitization. Attackers can inject arbitrary shell commands by wrapping payloads in backticks and encoding them in base64. Because the vulnerable endpoint requires no authentication, any host on the local network can achieve full remote code execution on the router with a single HTTP POST request.

Critical Impact
Unauthenticated attackers on the LAN can execute arbitrary OS commands as the router's privileged service account, leading to full device compromise.

Affected Products

Netis AC1200 Router NC21
Netis NC21 firmware version V4.0.1.4296
Endpoint /cgi-bin/skk_set.cgi

Discovery Timeline

2026-05-27 - CVE CVE-2026-36540 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-36540

Vulnerability Analysis

The vulnerability is a classic OS command injection flaw in an embedded device's web management interface. The /cgi-bin/skk_set.cgi handler accepts user-supplied values via the password and new_pwd_confirm POST parameters and concatenates them into a shell command without input validation or escaping. The handler also evaluates base64-encoded backtick expressions, which the shell interprets as command substitution before executing the outer command.

An attacker crafts a payload by wrapping arbitrary commands in backticks, encoding the result in base64, and submitting it through either parameter. The router decodes the value and the shell executes the injected commands. Because the CGI binary runs with elevated privileges typical of embedded router services, the injected commands inherit those privileges. Successful exploitation yields persistent control of the device, enabling traffic interception, DNS hijacking, lateral movement, and recruitment into botnets.

Root Cause

The root cause is missing input sanitization in the password-handling routine of skk_set.cgi. The endpoint trusts attacker-controlled POST data and passes it to a shell interpreter that honors backtick command substitution. Compounding the issue, the endpoint enforces no authentication, removing any precondition for exploitation.

Attack Vector

The attack vector is adjacent network access. An attacker on the same LAN segment as the router sends a single HTTP POST request to /cgi-bin/skk_set.cgi containing a base64-encoded backtick payload in the password or new_pwd_confirm field. The router decodes and executes the embedded command, granting the attacker code execution on the router's operating system. No credentials, user interaction, or prior foothold are required. See the GitHub CVE-2026-36540 Disclosure for proof-of-concept details.

Detection Methods for CVE-2026-36540

Indicators of Compromise

HTTP POST requests to /cgi-bin/skk_set.cgi originating from internal hosts that are not administrator workstations.
POST bodies containing base64-encoded strings inside password or new_pwd_confirm parameters, especially values that decode to backtick-wrapped shell commands.
Unexpected outbound connections from the router to attacker-controlled infrastructure following management interface requests.
New or modified processes, cron entries, or iptables rules on the router that were not introduced by the administrator.

Detection Strategies

Inspect HTTP traffic to the router's management interface for requests targeting skk_set.cgi with abnormally long or base64-encoded parameter values.
Alert on POST parameter values containing backtick characters (`), shell metacharacters, or base64 strings that decode to shell syntax.
Compare router firmware behavior and configuration against a known-good baseline to identify unauthorized changes.

Monitoring Recommendations

Forward DNS, DHCP, and NetFlow telemetry from network infrastructure into a centralized SIEM or data lake for correlation with endpoint events.
Monitor for anomalous administrative access patterns to the Netis web interface, including off-hours logins and rapid configuration changes.
Track DNS resolver changes on client devices, which may indicate router-level DNS hijacking after exploitation.

How to Mitigate CVE-2026-36540

Immediate Actions Required

Restrict access to the router's web management interface to a dedicated administrative VLAN or trusted management host only.
Disable remote management on the WAN interface if it is enabled.
Audit connected clients and the router's running configuration for signs of unauthorized changes, including modified DNS servers, port forwards, and firewall rules.
Replace the affected device with a supported model if the vendor does not issue a patch.

Patch Information

No vendor patch is referenced in the public advisory at the time of NVD publication. Administrators should monitor the Netis System Homepage for firmware updates addressing V4.0.1.4296 and apply them immediately upon release.

Workarounds

Place the Netis AC1200 NC21 behind a segmented network with strict ACLs that block lateral access to /cgi-bin/skk_set.cgi from general user subnets.
Use an upstream firewall or intrusion prevention system to drop HTTP POST requests to the router that contain backtick characters or base64-encoded shell metacharacters.
Change the default LAN subnet and management port to reduce opportunistic discovery, while recognizing this is obfuscation rather than a true fix.
If the device is non-essential, decommission it and replace it with a router from a vendor that issues timely security patches.

bash

# Example upstream firewall rule to restrict router management access
# Replace 192.0.2.10 with the trusted admin host and 192.0.2.1 with the router
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP