CVE-2026-112360 Netis EAP930 CGI Endpoint debug return200 backdoor
Attackers can bypass authentication via a backdoor in the debug CGI endpoint, though exploitation requires high complexity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112360?
CVE-2026-112360 is a high-severity authentication bypass vulnerability in Netis EAP930, published on 19 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-912
Which versions are affected by CVE-2026-112360?
How do I fix CVE-2026-112360?
No fix has been published for CVE-2026-112360 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-112360 being exploited?
There is no known exploitation of CVE-2026-112360 in the wild and no public exploit code.
Sources
Also known as GHSA-4wqx-c3pj-5r3f.