CVE-2026-36540 Command injection in n/a
Unauthenticated attackers on the LAN can execute arbitrary shell commands on Netis AC1200 routers via the skk_set.cgi endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-36540?
CVE-2026-36540 is a high-severity command injection vulnerability in n/a, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request.
Weakness: CWE-77
Which versions are affected by CVE-2026-36540?
How do I fix CVE-2026-36540?
No fix has been published for CVE-2026-36540 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-36540 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-36540 exists.
Sources
Also known as GHSA-x2w7-3ffq-rg3v.