What is the CVSS score of CVE-2026-36540?

CVE-2026-36540 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Netis AC1200 Router are affected by CVE-2026-36540?

Netis AC1200 Router (model NC21, firmware V4.0.1.4296) contains an unauthenticated remote command execution vulnerability that allows any local network attacker to execute arbitrary OS commands…

How to fix or mitigate CVE-2026-36540?

Within 24 hours: Inventory all Netis AC1200 NC21 routers and document network role and criticality. Within 7 days: Implement network segmentation to restrict LAN administrative access; deploy monitoring rules to alert on HTTP POST requests to /cgi-bin/skk_set.cgi containing suspicious patterns (base64-encoded backticks). Within 30 days: Contact Netis to confirm firmware availability for V4.0.1.4296 or develop equipment replacement timeline; consider priority replacement if firmware patch released.

Netis AC1200 Router CVE-2026-36540

HIGH

Command Injection (CWE-77)

2026-05-27 cve@mitre.org

Command Injection RCE

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 14:23 vuln.today

CVSS changed

May 28, 2026 - 14:22 NVD

7.3 (HIGH)

CVE Published

May 27, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request.

AnalysisAI

Unauthenticated remote command injection in the Netis AC1200 Router (model NC21, firmware V4.0.1.4296) allows any LAN-resident attacker to execute arbitrary OS commands as the router's runtime user via a single HTTP POST to /cgi-bin/skk_set.cgi. The password and new_pwd_confirm parameters are concatenated into a shell invocation without sanitization, and exploitation requires no credentials. No public exploit is identified at time of analysis, though the disclosure repository documents the technique (base64-encoded backtick payloads), and EPSS scoring (0.21%) suggests limited broad exploitation pressure despite the trivial attack complexity.

Technical ContextAI

The affected component is the skk_set.cgi handler in the web management interface of Netis NC21 firmware V4.0.1.4296, a SOHO Wi-Fi router platform. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command) - user-controlled POST fields are interpolated into an OS shell command, so backtick-wrapped payloads are evaluated by the shell as command substitution. The disclosure notes a base64 encoding step, which typically indicates the CGI script decodes the parameter server-side before passing it to system()/popen()-style execution, allowing the attacker to bypass any naive character filtering on the raw HTTP body. No CPE entries are published in the provided NVD data, so affected SKUs beyond the explicitly named NC21 build cannot be enumerated from structured sources.

Affected ProductsAI

Netis AC1200 Router, model NC21, firmware version V4.0.1.4296 is the only build explicitly confirmed vulnerable per the CVE description; other AC1200 hardware revisions or firmware versions are not enumerated in the available data (no CPE published). The vendor reference is the Netis system site at http://netis-system.com, and the discloser's writeup is hosted at https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md.

RemediationAI

No vendor-released patch identified at time of analysis - neither the NVD references nor the discloser's repository cite a fixed firmware build. Operators should check the Netis support portal (http://netis-system.com) for an updated NC21 firmware superseding V4.0.1.4296 and apply it once available. As compensating controls until a patch ships, disable remote (WAN-side) management of the web UI if enabled (side effect: lose remote administration), segment the router's management interface onto a dedicated VLAN or management SSID so untrusted LAN clients and guest networks cannot reach /cgi-bin/skk_set.cgi (side effect: requires re-architecting admin access), and consider an ACL or firewall rule blocking POST requests to /cgi-bin/skk_set.cgi from non-administrative subnets (side effect: legitimate password-change flows from those subnets will also fail). For high-risk deployments, replacing the device is the most durable mitigation given vendor patch cadence is unknown.