Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-61516Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Critical 9.8

In plain English

A critical-severity security flaw in NX10 from Netis Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 46.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.

Affected products (as reported)

Vendor	Product	Versions
Netis Systems	NX10	4.0.1.58083.0.0.4142

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Researcher Advisory technical-description
Product Webpage product
https://www.vulncheck.com/advisories/netis-nx10-credential-disclosure-via-sysinfo-diagnostic-endpoint third-party-advisory