EUVD-2026-58623
GHSA-mqjf-hpmj-9gr8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector reflects LAN/Wi-Fi-only reachability; PR:N and UI:N confirmed by unauthenticated direct POST exploitation; all CIA metrics High due to arbitrary firmware flash capability; no scope change as impact is contained to the router itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.
AnalysisAI
Unauthenticated firmware flashing in Netis NC63 routers (firmware V3.0.0.3327) allows any attacker on the same network segment to permanently compromise the device by uploading arbitrary firmware without credentials. Two compounding flaws enable this: the embedded Boa web server grants access to any URL path containing '.cgi' regardless of session cookie validity, and the netis.cgi CGI dispatcher reads but never enforces the authentication state before invoking the firmware update handler. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be on the same adjacent network segment as the router (LAN or Wi-Fi broadcast domain) - the vulnerability is not directly Internet-exploitable unless the management HTTP port is forwarded externally. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 8.7 and accurately reflects the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connected to the same Wi-Fi network as the Netis NC63 router crafts a multipart POST request to http://[router-ip]/cgi-bin/upload_fw.cgi with no session cookie. The Boa server grants the request because the path contains '.cgi'; netis.cgi dispatches it to the firmware update handler without checking the unenforced authentication flag. … |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: scan networks for Netis NC63 devices and confirm firmware version; segregate affected routers to restricted network segments and disable remote management if operationally possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today