Is CVE-2026-36540 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36540 being exploited in the wild.

How severe is CVE-2026-36540?

Informational severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

Netis Systems AC1200 Router NC21 V4.0.1.4296.

Is there a fix for CVE-2026-36540?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36540 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-36540?

Check whether you run Netis Systems AC1200 Router NC21 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36540: Netis AC1200 Router command injection in skk_set.cgi

CVE-2026-36540 · Severity: info · CVSS 8.8 · Published 2026-05-27

The Netis AC1200 router is a networking device used to provide internet connectivity to homes and small offices. A security flaw allows an unauthenticated person on the local network to take complete control of the router. This could lead to the interception of internet traffic, theft of credentials, or the use of the router as a foothold for further attacks on other connected devices.

Technologies: Netis Systems AC1200 Router NC21. Vendors: Netis Systems.

Quick answers

Is CVE-2026-36540 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36540 being exploited in the wild.
How severe is CVE-2026-36540?: Informational severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: Netis Systems AC1200 Router NC21 V4.0.1.4296.
Is there a fix for CVE-2026-36540?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36540 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-36540?: Check whether you run Netis Systems AC1200 Router NC21 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated command injection vulnerability exists in the Netis AC1200 Router NC21 (firmware V4.0.1.4296) within the /cgi-bin/skk_set.cgi endpoint. The 'password' and 'new_pwd_confirm' POST parameters are passed directly to the underlying OS shell without sanitization. An attacker on the local network can achieve Remote Code Execution (RCE) by sending a specially crafted HTTP POST request containing shell commands wrapped in backticks and encoded in base64. As of the disclosure date, the vendor has not responded to reports and no patch is available.

Affected products

Netis AC1200 Router NC21 V4.0.1.4296

Timeline

2026-02-23: other: Vulnerability discovered
2026-02-24: other: Attempted to contact vendor Netis; no response received
2026-05-27: advisory: CVE published by NVD/MITRE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.