Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-61516: Netis NX10 reveals admin password via web info page
CVE-2026-61516 · published 1 month ago
Summary
The Netis NX10 router lets anyone view the admin password by requesting the system information page on its web interface, without needing to log in. An attacker could then use that password to log in as the administrator and take full control of the device. Update the router firmware to the latest version or restrict access to the web management interface to trusted users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| netis systems | nx10 | 4.0.1.5808 |
Original advisory text
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published8 Sep 2026
Updated14 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta