What is the CVSS score of CVE-2026-36538?

CVE-2026-36538 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Netis AC1200 Router are affected by CVE-2026-36538?

All Netis AC1200 Router NC21 devices running firmware V4.0.1.4296 in your environment share identical hard-coded administrative credentials, creating critical exposure if the management interface is…

How to fix or mitigate CVE-2026-36538?

Within 24 hours: Identify all Netis AC1200 Router NC21 devices running firmware V4.0.1.4296; immediately restrict management interface access via firewall rules to known trusted internal IP ranges only; disable remote management features. Within 7 days: Implement network segmentation isolating management ports from general network traffic; enable authentication logging on management interfaces; document all access points and review logs for unauthorized access attempts. Within 30 days: Deploy patched firmware version when released by Netis or execute device replacement plan with enterprise-grade router solutions if patch remains unavailable beyond 30 days.

Netis AC1200 Router CVE-2026-36538

HIGH

Use of Hard-coded Credentials (CWE-798)

2026-05-27 cve@mitre.org

Authentication Bypass

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 14:22 vuln.today

CVSS changed

May 28, 2026 - 14:22 NVD

7.3 (HIGH)

CVE Published

May 27, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authenticate as root and gain full control of the underlying operating system.

AnalysisAI

Hard-coded root credentials in Netis AC1200 Router NC21 firmware V4.0.1.4296 allow attackers who reach the device to log in as root using the trivially guessable password 'root' stored in /etc/shadow.sample. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the credential is static across affected units, making any exposed management interface a one-step compromise. The flaw is classified as CWE-798 (Use of Hard-coded Credentials) and is tagged as an Authentication Bypass.

Technical ContextAI

The affected device is a Netis AC1200 dual-band consumer/SOHO wireless router (model NC21) running firmware V4.0.1.4296, built on an embedded Linux base where Unix-style account information is stored under /etc/shadow. The firmware ships a /etc/shadow.sample file containing a root account whose password hash decrypts to the literal string 'root'. CWE-798 describes exactly this class of defect: credentials embedded in shipped software or firmware that cannot be rotated by ordinary configuration and therefore apply identically to every deployed unit, undermining any per-device authentication assumption. Because Linux PAM and dropbear/openssh-style daemons commonly resolve authentication against this account database, anyone reaching an authentication surface (SSH, telnet, web UI, debug console) that consults the system password file can present root/root and obtain a full OS-level session.

Affected ProductsAI

Netis AC1200 Router, model NC21, firmware version V4.0.1.4296 is the only build named in the disclosure; no CPE strings were provided in the input and other NC21 firmware revisions or sibling AC1200 models cannot be confirmed affected or unaffected from the available data. Vendor reference is the Netis homepage at http://netis-system.com and the third-party disclosure write-up is at https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36538/readme.md.

RemediationAI

No vendor-released patch identified at time of analysis; the Netis reference (http://netis-system.com) and the researcher disclosure (https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36538/readme.md) should be monitored for a firmware update for NC21 superseding V4.0.1.4296. Until a fixed firmware ships, operators should manually change the root password via the device shell if accessible (side effect: may be reverted on factory reset or firmware upgrade), disable remote/WAN management entirely in the router admin UI (side effect: loses remote administration capability), restrict LAN-side access to SSH, telnet, and the web admin to a trusted management VLAN or single admin host via firewall rules (side effect: requires VLAN-capable network), and where feasible replace the device given that hard-coded credentials in consumer routers often indicate broader firmware hygiene issues.