CVE-2026-61516: Netis NX10 Information Disclosure Vulnerability

CVE-2026-61516 Overview

CVE-2026-61516 is an information disclosure vulnerability in Netis NX10 router firmware versions V4.0.1.5808 and V3.0.0.4142. The flaw resides in the sysinfo action of the web management interface, which returns the administrator password to unauthenticated clients. An attacker on the same network segment or with routed access to the management interface can issue a single HTTP request to retrieve the credential. The exposed password can then be replayed against the login handler to gain full administrative control of the device. The weakness is classified under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Unauthenticated attackers can retrieve the administrator password and establish a full admin session on affected Netis NX10 routers with no user interaction.

Affected Products

Netis NX10 firmware V4.0.1.5808
Netis NX10 firmware V3.0.0.4142
Netis NX10 wireless router hardware running the affected firmware branches

Discovery Timeline

2026-09-08 - CVE-2026-61516 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-61516

Vulnerability Analysis

The Netis NX10 web management interface exposes a diagnostic action named sysinfo. This action responds to HTTP requests without validating that the caller holds an authenticated session. The response body includes device configuration data along with the plaintext administrator password. An attacker only needs network reachability to the management interface to trigger the disclosure. After capturing the credential, the attacker submits it to the standard login handler and receives a valid administrator session cookie. From that session, the attacker can modify routing, DNS, firewall, and firmware settings, which enables persistent traffic interception and pivoting into internal networks.

Root Cause

The root cause is a missing authorization check on the sysinfo endpoint combined with storage of the administrator password in a form that can be returned to a caller. The web server treats the diagnostic action as public and serializes sensitive credential material into its response. This is a classic instance of [CWE-522] where credentials are transmitted or stored without adequate protection.

Attack Vector

Exploitation requires a network-reachable path to the router's management interface and no authentication, no privileges, and no user interaction. An attacker sends an HTTP request to the sysinfo action, parses the returned administrator password, and posts that credential to the login endpoint to receive a session token. Because the disclosed value is the actual configured password, credential rotation is required even after patching. Refer to the VulnCheck Advisory and the Hack with Mike Advisory for endpoint specifics and request examples.

Detection Methods for CVE-2026-61516

Indicators of Compromise

Unauthenticated HTTP requests to the sysinfo action on the router management interface originating from unexpected internal or external hosts.
Successful administrator login events immediately following a sysinfo request from the same source address.
Unexpected changes to DNS, WAN, or firewall configuration on Netis NX10 devices.
New administrative sessions established outside normal maintenance windows.

Detection Strategies

Inspect HTTP access logs on the router or an upstream reverse proxy for requests that reference the sysinfo action without a prior authenticated session.
Correlate sysinfo requests with subsequent POSTs to the login handler from the same source within a short time window.
Alert on any access to the router web interface from hosts that are not part of the network administration allowlist.

Monitoring Recommendations

Forward router syslog and web access logs to a centralized logging platform for retention and correlation.
Baseline normal administrative activity and alert on out-of-band configuration changes on the NX10.
Monitor for repeated scanning patterns targeting Netis management ports across the network edge.

How to Mitigate CVE-2026-61516

Immediate Actions Required

Restrict access to the Netis NX10 web management interface to trusted management VLANs and specific administrator hosts.
Disable remote (WAN-side) management on affected devices until a fixed firmware release is applied.
Rotate the administrator password after any suspected exposure, since the disclosed value cannot be revoked by patching alone.
Audit device configuration for unauthorized changes to DNS servers, firewall rules, and port forwarding entries.

Patch Information

At the time of publication, no vendor advisory or fixed firmware version is referenced in the NVD entry for CVE-2026-61516. Administrators should monitor the Netis NX10 Product Page for firmware updates and consult the VulnCheck Advisory for any updates regarding vendor remediation status.

Workarounds

Place the router management interface behind a firewall rule that permits only trusted source addresses.
Segment the router management network from user and guest networks to reduce attacker reachability.
Replace affected NX10 devices with hardware receiving active vendor security support when patching is not feasible.

bash

# Example: restrict access to the router management interface with iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 80 \
    -s <admin_workstation_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 443 \
    -s <admin_workstation_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 443 -j DROP