Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-61516

Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Netis-systems
Products
Nx10
CVE-2026-61517

Netis NX10 OS Command Injection via Ping Diagnostic Handler

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.

CVSS 4.0 · 8.6 High EPSS 2.5% KEV · Not listed
Vendors
Netis-systems
Products
Nx10