4
CVEs
3
Critical
1
High
0
KEV
4
PoC
4
Unpatched C/H
0.0%
Patch Rate
1.0%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (16)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76071 | Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed. | CRITICAL | 9.3 | 1.1% | 68 |
PoC
No patch
|
| CVE-2026-76070 | Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks. | CRITICAL | 9.3 | 1.0% | 66 |
PoC
No patch
|
| CVE-2026-61516 | Unauthenticated credential disclosure in Netis NX10 routers (firmware V4.0.1.5808 and V3.0.0.4142) lets remote attackers retrieve the administrator password by sending a request to the 'sysinfo' action of the web management interface without any session. The exposed credential can then be replayed against the login handler to establish a fully authenticated administrator session, yielding complete device takeover. Publicly available exploit code exists (published by VulnCheck/hackwithmike), and the network-reachable, no-auth nature makes this straightforward to weaponize. | CRITICAL | 9.3 | 0.4% | 66 |
PoC
No patch
|
| CVE-2026-61517 | OS command injection in the Netis NX10 router's ping diagnostic handler allows authenticated administrators to execute arbitrary commands as root by embedding shell metacharacters in the IpAddr parameter. The device's firmware (V4.0.1.5808 and V3.0.0.4142) interpolates this parameter directly into a system() call with an incomplete denylist that filters spaces, pipes, semicolons, and ampersands but leaves command substitution syntax ($() and backticks) and IFS-based space bypasses fully exploitable. A publicly available exploit is referenced via VulnCheck and hackwithmike.com; no vendor-released patch has been identified at time of analysis. | HIGH | 8.6 | 1.6% | 65 |
PoC
No patch
|