CVE-2026-61517 Details

A command injection vulnerability has been identified in the Netis NX10 router, specifically in firmware versions 4.0.1.5808 and 3.0.0.4142. The issue arises in the ping diagnostic handler, where authenticated administrators can execute arbitrary shell commands as root. This exploitation is achieved by injecting commands into the IpAddr parameter, which is directly passed into a shell command executed via the system() function. The vulnerability exists due to an inadequate denylist that only prevents spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion open for exploitation.