Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61517

Netis NX10 OS Command Injection via Ping Diagnostic Handler

CVSS 4.0 8.6 HIGHCVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61517

Published

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61517

Published

NX10

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "Netis Systems",
                    "product": "NX10",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "4.0.1.5808",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "3.0.0.4142",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON