Description

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T15:18:44.170Z",
  "pubdate": "2026-09-08T15:18:44.170Z",
  "executiveSummary": "Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 are affected by an information disclosure vulnerability within the web management interface.\nThis vulnerability allows unauthenticated remote attackers to extract the cleartext administrator password by interacting with the sysinfo action.\nThe flaw stems from improper access control mechanisms that fail to enforce authentication requirements for specific sensitive system management endpoints.\nSuccessful exploitation enables full administrative control over the affected network device, posing a critical risk to confidentiality, integrity, and availability.\nAttackers do not require prior access to the system or valid user credentials to initiate the attack, as the disclosure occurs via a direct, unauthorized HTTP request.\nThe exposed credentials can be immediately replayed against the authentication handler to facilitate unauthorized administrative sessions, effectively bypassing all primary security controls on the router.",
  "technicalDetails": "The vulnerability resides in the web management interface of the Netis NX10 router, specifically within the handling logic of the 'sysinfo' action. The root cause is a lack of session validation or authentication enforcement on this endpoint, allowing unauthenticated network entities to query the system state.\nThe attack flow begins when an unauthenticated attacker sends a specially crafted HTTP request targeting the sysinfo endpoint. Under normal operational security, this endpoint should verify an active session cookie or a valid authorization header; however, the vulnerable firmware versions fail to perform these checks.\nUpon receiving the request, the underlying backend service processes the sysinfo call and erroneously includes the administrator's password in the plaintext response. The disclosure of this credential occurs due to the insecure design of the administrative information exposure routine, which lacks adequate access control lists (ACLs).\nOnce the administrator's password is successfully exfiltrated, the attacker proceeds to the second stage of exploitation: credential replay. The attacker submits the obtained credentials to the device's login handler, typically via a POST request designed to initiate a session. Since the retrieved credentials are valid for the administrative account, the web server processes the request and issues a session identifier (e.g., a session cookie) to the attacker.\nWith a valid session identifier, the attacker gains full administrative access to the device. This provides the capability to modify network settings, redirect traffic, update firmware with malicious images, or disable security features such as firewalls and intrusion detection systems. The impact of this exploit is catastrophic, as it grants complete control over the device management plane without leaving typical logs of brute-force or dictionary-style attacks, as the attacker effectively 'logs in' as the legitimate administrator.\nAffected firmware versions are V4.0.1.5808 and V3.0.0.4142. The vulnerability is exploitable over any network interface that permits access to the management web interface, including the WAN interface if remote management is enabled, or the LAN interface for locally connected adversaries."
}