CVE-2026-61517

Netis NX10 router firmware contains an OS command injection flaw (CWE-78) in the ping diagnostic handler, where the IpAddr parameter is interpolated directly into a shell command executed via system(). An authenticated administrator can inject arbitrary commands because the denylist only blocks spaces, pipes, semicolons, and ampersands, leaving shell command substitution and alternate-IFS expansion available for bypass. Successful exploitation executes arbitrary shell commands as root, giving an attacker full control of the device (config, DNS, firmware, or use as a network foothold). Only Netis NX10 routers running the affected firmware versions are affected, and the attacker must have administrator access, typically via a LAN-side or WAN-exposed management UI with known or guessed admin credentials. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS puts 30-day exploitation probability at 1.6% (74th percentile), and the issue is not in CISA KEV.

What to do: Check your NX10 firmware version on the router's status page and upgrade to a patched Netis firmware release when the vendor publishes one (no fixed version is specified in the data). Until then, limit the web management UI to the LAN side (disable or firewall WAN-side remote management), set a strong non-default administrator password, and audit for unexpected configuration changes or unfamiliar processes, since exploitation yields root-level command execution.