Description

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T13:19:09.573Z",
  "pubdate": "2026-08-14T13:19:09.573Z",
  "executiveSummary": "Netis NC63 router firmware version V3.0.0.3327 suffers from an unauthenticated firmware update vulnerability.\nThe vulnerability allows remote, unauthenticated attackers to upload and apply arbitrary, unsigned firmware images to the affected device.\nThis flaw resides in the Boa web server and the netis.cgi CGI dispatcher, which fail to properly enforce authentication requirements prior to handling firmware update procedures.\nAn attacker can exploit this weakness by submitting a crafted multipart POST request directly to the endpoint without requiring a valid session cookie.\nThe validation mechanism for uploaded images relies exclusively on a forgeable additive checksum and static product strings rather than cryptographic signatures, allowing malicious images to pass verification checks.\nSuccessful exploitation results in complete loss of device integrity, enabling persistent router compromise, unauthorized access to network traffic, and full administrative control over the underlying operating system.\nThe risk implication is severe, as exposed devices are vulnerable to remote takeover without prior interaction or privileged credentials.",
  "technicalDetails": "The vulnerability stems from a missing authentication enforcement flaw spanning the Boa web server configuration and the netis.cgi CGI dispatcher.\nThe affected product is Netis NC63 router running firmware version V3.0.0.3327.\nThe attack vector is network-exposed, requiring network connectivity to the router web management interface.\nAuthentication requirements are entirely absent, permitting unauthenticated attackers to interact with restricted endpoints.\nPrivilege requirements are nonexistent, as no prior user roles or session validation are enforced.\nThe vulnerable components include the Boa web server configuration and the netis.cgi CGI dispatcher that processes requests destined for /cgi-bin/upload_fw.cgi.\nThe root cause is twofold: first, the Boa web server incorrectly grants access to any requested path containing the '.cgi' extension, bypassing mandatory cookie validation checks; second, the netis.cgi handler reads the authentication state from incoming requests but fails to enforce it before dispatching execution to the underlying firmware update handler.\nThe step-by-step attack flow proceeds as follows: 1) An unauthenticated attacker crafts a multipart POST request containing an arbitrary firmware image payload. 2) The attacker transmits this HTTP request to the target URL /cgi-bin/upload_fw.cgi over the network. 3) The Boa web server receives the request and bypasses cookie validation because the target path contains '.cgi'. 4) The netis.cgi dispatcher receives the request, reads the missing or invalid session state, but executes the firmware update handler regardless of the unauthenticated status. 5) The update handler evaluates the incoming image using a weak validation mechanism consisting only of a forgeable additive checksum and static product strings, completely omitting cryptographic signature verification. 6) The malicious firmware image is accepted, written to flash storage, and executed upon reboot.\nThe payload behavior involves replacing legitimate firmware components with arbitrary code supplied by the attacker.\nThe post-exploitation impact includes persistent router compromise, arbitrary code execution with highest privileges, potential man-in-the-middle positioning on local network traffic, and long-term device destabilization or bricking."
}