EUVD-2026-72808
GHSA-86qh-7j58-596j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin authentication required (PR:H); network-reachable interface (AV:N); no scope change as impact stays within device OS boundary (S:U); full root access yields C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.
AnalysisAI
OS command injection in the Netis NX10 router's ping diagnostic handler allows authenticated administrators to execute arbitrary commands as root by embedding shell metacharacters in the IpAddr parameter. The device's firmware (V4.0.1.5808 and V3.0.0.4142) interpolates this parameter directly into a system() call with an incomplete denylist that filters spaces, pipes, semicolons, and ampersands but leaves command substitution syntax ($() and backticks) and IFS-based space bypasses fully exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication as an administrator is required - the CVSS 4.0 PR:H metric confirms this is not an unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) yields an 8.6 score, which accurately reflects that while the impact is critical (root command execution), the prerequisite of administrator authentication (PR:H) substantially constrains real-world reach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all administrative accounts on affected Netis NX10 devices (firmware V4.0.1.5808 and V3.0.0.4142) for unauthorized activity, disable the diagnostic interface if not operationally required, and enable all available logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today