CVE-2026-36540

{
  "id": "CVE-2026-36540",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T14:16:45.637",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. The password and new_pwd_confirm POST parameters are passed directly to the underlying OS shell without sanitization. An attacker can inject arbitrary shell commands by wrapping them in backticks (`) and encoding them in base64. Because the endpoint requires no authentication, any device on the LAN can achieve full Remote Code Execution on the router's operating system with a single HTTP POST request."
    },
    {
      "lang": "es",
      "value": "Netis AC1200 Router NC21 V4.0.1.4296 es vulnerable a inyección de comandos no autenticada a través del endpoint /cgi-bin/skk_set.cgi. Los parámetros POST password y new_pwd_confirm se pasan directamente al shell del sistema operativo subyacente sin sanitización. Un atacante puede inyectar comandos de shell arbitrarios envolviéndolos entre comillas invertidas (”) y codificándolos en base64. Debido a que el endpoint no requiere autenticación, cualquier dispositivo en la LAN puede lograr la ejecución remota de código completa en el sistema operativo del router con una única solicitud HTTP POST."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:41:25.316769Z",
          "id": "CVE-2026-36540",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}