CVE-2026-73673
Last modified
CVE-2026-73673 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise..
Description
Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Netis Systems Co., Ltd. | Netis NC63 Wireless AC1200 Router | <= V3.0.0.3327 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-73673?
How severe is CVE-2026-73673?
How do I fix CVE-2026-73673?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73665FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP N…9.3
- CVE-2026-73666OpenChoreo is a developer platform for Kubernetes. Prior to …8.2
- CVE-2026-73667OpenChoreo is a complete, open-source developer platform for…8.8
- CVE-2026-73669The Signify Philips Hue Bridge Pro firmware embeds a Mosquit…7.3
- CVE-2026-73670A CMS contains a SQL injection vulnerability in admin/db_dat…8.6
- CVE-2026-73671Saurus CMS Community Edition contains an unauthenticated ope…6.1
- CVE-2026-73678MindsDB Minds Platform version 26.1.0 and earlier contains a…10
- CVE-2026-73679ImpressCMS contains an authenticated remote code execution v…7.2
- CVE-2026-7368The Yarbo cloud does not enforce per-device or per-user auth…8.6
- CVE-2026-73680Cockpit CMS 2.14.0 and prior contains a command injection vu…8.8
- CVE-2026-73682Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-73683Laravel Socialite's Facebook provider contains an authentica…8.1
Are you affected by CVE-2026-73673?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST