CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler
Authenticated administrators can execute arbitrary shell commands as root on Netis NX10 devices via the ping diagnostic handler.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61517?
CVE-2026-61517 is a high-severity command injection vulnerability in Netis Systems NX10, published on 8 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.
Weakness: CWE-78
Which versions are affected by CVE-2026-61517?
How do I fix CVE-2026-61517?
No fix has been published for CVE-2026-61517 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-61517 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61517 exists.
Sources
Also known as GHSA-86qh-7j58-596j.