# CVE-2026-36539: Netis AC1200 Router NC21 unauthenticated information disclosure in skk_get.cgi

Source: https://junglewise.ai/threats/cve-2026-36539-netis-ac1200-router-nc21-unauthenticated-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-36539 · Severity: info · CVSS 8.8 · Published 2026-05-27

The Netis AC1200 Router NC21 contains a security flaw that allows anyone on the local network to access the device's full configuration without a password. This includes the exposure of administrator credentials, Wi-Fi passwords, and internet connection details. An attacker could use this information to take complete control of the router, monitor network traffic, or gain access to other devices in the home or office.

Technologies: [Netis Systems AC1200 Router NC21](https://junglewise.ai/threats/technologies/ac1200-router-nc21). Vendors: [Netis Systems](https://junglewise.ai/threats/vendors/netis-systems).

## Quick answers

**Is CVE-2026-36539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36539 being exploited in the wild.

**How severe is CVE-2026-36539?** Informational severity, with a CVSS score of 8.8, published 27 May 2026.

**Which products and versions are affected?** Netis Systems AC1200 Router NC21 V4.0.1.4296.

**Is there a fix for CVE-2026-36539?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36539 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-36539?** Check whether you run Netis Systems AC1200 Router NC21 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Netis AC1200 Router NC21 running firmware V4.0.1.4296 contains an unauthenticated information disclosure vulnerability in the /cgi-bin/skk_get.cgi endpoint. An attacker on the local area network (LAN) can trigger this vulnerability by sending a simple HTTP GET request to the affected endpoint. The server responds with a JSON object containing the complete device configuration, including administrator passwords, Wi-Fi PSKs, PPPoE credentials, and DDNS credentials. While these sensitive values are Base64-encoded, they are not encrypted and can be trivially decoded. As of the disclosure date, the vendor has not released a patch.

## Affected products

- Netis Systems AC1200 Router NC21 V4.0.1.4296

## Timeline

- 2026-05-27: disclosed: Vulnerability disclosed via GitHub and NVD
- 2026-05-27: advisory

## References

- [https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36539/readme.md](https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36539/readme.md)

## Related threats

- [Netis AC1200 Router command injection in skk_set.cgi](https://junglewise.ai/threats/cve-2026-36540-netis-ac1200-router-command-injection-in-skk-set-cgi)
- [Netis AC1200 Router hard-coded root credential](https://junglewise.ai/threats/cve-2026-36538-netis-ac1200-router-hard-coded-root-credential)