Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-61517Netis NX10 OS Command Injection via Ping Diagnostic Handler

High 7.2

In plain English

A high-severity OS command injection in NX10 from Netis Systems. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.5%top 15.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.

Affected products (as reported)

Vendor	Product	Versions
Netis Systems	NX10	4.0.1.58083.0.0.4142

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Researcher Advisory technical-description
Product Webpage product
https://www.vulncheck.com/advisories/netis-nx10-os-command-injection-via-ping-diagnostic-handler third-party-advisory