Netis NX10 Router Unauthenticated Admin Credential Disclosure

Technical Analysis

The vulnerability (CVE-2026-61516) resides in the sysinfo endpoint of the Netis NX10 web management interface, which fails to enforce session authentication before returning device configuration data, including the plaintext or reversible administrator password. An attacker can send a crafted HTTP request directly to this endpoint to harvest credentials, then use them to authenticate to the router's admin panel, gaining persistent control over routing, DNS, firmware, and connected device traffic. This is a classic broken access control / information disclosure flaw (CWE-200/CWE-306 class) rather than a memory corruption bug, making exploitation trivial and scriptable at scale via internet-wide scanning. Organizations that deploy AI agents or LLM-based automation on networks behind these routers face risk if agents rely on the compromised network path for API calls or tool invocations, as attacker-controlled DNS/routing could enable traffic interception, credential harvesting, or man-in-the-middle attacks against agent-to-cloud API traffic; this is a plausible but indirect agent-relevant risk rather than a direct compromise of agent software.

Affected Systems

Netis NX10 router firmware versions V4.0.1.5808 and V3.0.0.4142; web management interface sysinfo action endpoint

Indicators of Compromise

• N/A - vulnerability advisory; no specific malware hashes, IPs, or domains published at this time. Indicators would include anomalous unauthenticated HTTP requests to /sysinfo or similar admin endpoints on Netis NX10 devices, and unexpected admin login events without corresponding prior session establishment.

Remediation Steps

1. 1

   Apply firmware update

   Check Netis's official support channels for a patched firmware release addressing CVE-2026-61516 and update all affected NX10 devices immediately.

2. 2

   Restrict management interface access

   Disable remote/WAN access to the router's web management interface and restrict access to trusted LAN IP ranges or a management VLAN.

3. 3

   Change default and exposed credentials

   Rotate the administrator password on all affected devices and avoid default credentials, even after patching.

4. 4

   Network segmentation

   Isolate IoT and edge network devices, including routers, from critical infrastructure and systems running AI agent workloads or handling sensitive API keys.

5. 5

   Monitor for exploitation

   Deploy network monitoring to detect unauthenticated requests to sysinfo or similar diagnostic endpoints and flag unexpected admin authentication events.

6. 6

   Device replacement consideration

   If no patch is available, consider replacing affected devices with vendors that have a stronger security update track record, especially for internet-facing deployments.