Netis-systems vulnerabilities
We track 32 vulnerabilities in Netis-systems products across 14 products. 32 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 8, 2026.
Latest Netis-systems vulnerabilities
- 7.2 High severity
NX10: Improper Neutralization of Special Elements used in an OS Command
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parame
- 9.8 Critical severity
NX10: Insufficiently Protected Credentials
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a va
- 9.8 Critical severity
NC63: Stack-based Buffer Overflow
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. A
- 9.8 Critical severity
NC63: Stack-based Buffer Overflow
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi.
- 8.8 High severity
Netis NC63 Wireless AC1200 Router: Missing Authentication for Critical Functionality
Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cg
- 7.5 High severity
Wf2880 Firmware: Heap-based Buffer Overflow
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wps_set in the payload, which can cause the program to cra
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_advanced_set in the payload, which can cause the progra
- 7.5 High severity
Wf2880 Firmware: Uncontrolled Resource Consumption
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_mac_filter_set in the payload, which can cause the prog
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_set in the payload, which can cause the program to
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_key_wep in the payload, which can cause the program to
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set in the payload, which may cause the program
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set_5g and wl_sec_rp_set_5g in the payload, which c
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set_5g in the payload, which can cause the program
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of specify_parame in the payload, which can cause the program to
- 7.5 High severity
Wf2880 Firmware: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set in the payload, which can cause the program to
- 7.5 High severity
Wf2780 Firmware: NULL Pointer Dereference
A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. The vulnerability exists in the FUN_0048a728 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the CONTENT_LENGTH variable, causing the
- 7.5 High severity
Wf2880 Firmware: NULL Pointer Dereference
A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the environment variable value CONTENT_LE
- 8.7 High severity
WF2220: Missing Authentication for Critical Functionality
Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was conta
- 8.7 High severity
WF2220: Plaintext Storage of a Password
WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.
- 7.5 High severity
n3m: Buffer Copy without Checking Size of Input
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
n3m: Buffer Copy without Checking Size of Input
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
n3m_firmware: Buffer Copy without Checking Size of Input
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- 7.5 High severity
n3m_firmware: Incorrect Authorization
An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.
- 9.8 Critical severity
n3m_firmware: Improper Neutralization of Special Elements used in an OS Command
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.
- 9.8 Critical severity
n3m_firmware: Improper Neutralization of Special Elements used in an OS Command
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.
- 9.8 Critical severity
n3m_firmware: Improper Neutralization of Special Elements used in a Command
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
- 8.8 High severity
n3m_firmware: Improper Neutralization of Special Elements used in an OS Command
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request.
- 9.8 Critical severity
360rac1200: Missing Authorization
There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
- 9.8 Critical severity
wf2409e: Use of Hard-coded Credentials
An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component.
- 8.8 High severity
wf2409e: Improper Neutralization of Special Elements used in a Command
An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.
- 7.5 High severity
Netcore Router: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information dis
- 7.5 High severity
Netis WF2419 Devices Remote Code Execution Exploited
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execu