Netis Nc63 Wireless Ac1200 Router
Monthly
Unauthenticated firmware flashing in Netis NC63 routers (firmware V3.0.0.3327) allows any attacker on the same network segment to permanently compromise the device by uploading arbitrary firmware without credentials. Two compounding flaws enable this: the embedded Boa web server grants access to any URL path containing '.cgi' regardless of session cookie validity, and the netis.cgi CGI dispatcher reads but never enforces the authentication state before invoking the firmware update handler. Firmware images are accepted if they pass only a forgeable additive checksum and static product string checks - no cryptographic signature verification is performed. A public proof-of-concept exploit exists on GitHub (ozcanpng/CVE-2026-73673), and no vendor-released patch has been identified at time of analysis.
Unauthenticated firmware flashing in Netis NC63 routers (firmware V3.0.0.3327) allows any attacker on the same network segment to permanently compromise the device by uploading arbitrary firmware without credentials. Two compounding flaws enable this: the embedded Boa web server grants access to any URL path containing '.cgi' regardless of session cookie validity, and the netis.cgi CGI dispatcher reads but never enforces the authentication state before invoking the firmware update handler. Firmware images are accepted if they pass only a forgeable additive checksum and static product string checks - no cryptographic signature verification is performed. A public proof-of-concept exploit exists on GitHub (ozcanpng/CVE-2026-73673), and no vendor-released patch has been identified at time of analysis.