Netis router bug hands out the admin password to anyone who asks

A newly disclosed bug in the Netis NX10 Wi-Fi 6 router lets anyone on the network fetch the administrator password without logging in first - no exploit chain required, just a plain HTTP request. It’s been catalogued as CVE-2026-61516, and it’s being talked about as critical. Whether it deserves the full 9.8 out of 10 is, on the evidence available, an open question.

What the bug actually does

According to the researcher who found it, writing on hackwithmike.com, the NX10’s login page quietly calls a backend endpoint called skk_get.cgi?sysinfo before you’ve authenticated, to pull basic device state for the login screen. The problem is that this endpoint’s response includes the stored admin password in plain view, and it doesn’t check for a session cookie at all. Anyone who can reach the router’s web interface can just ask for this data directly.

Worse, the login handler will accept that harvested password straight back as a valid credential - so an attacker can scrape the value and immediately log in as administrator, all in a couple of scripted requests. The advisory even publishes the working curl commands.

It gets murkier still: the same researcher found a separate command-injection flaw (CVE-2026-61517) elsewhere in the firmware. Chain the two together and you go from zero credentials to a root shell on the device - the kind of full compromise normally associated with far more elaborate attacks.

So who is actually at risk

This affects the Netis NX10, an AX1500 Wi-Fi 6 router, specifically firmware versions V4.0.1.5808 and V3.0.0.4142, which is what the researcher confirmed by testing in an emulated environment (using FirmAE and QEMU) rather than on physical hardware. Whether other firmware branches or Netis models share the same flawed code hasn’t been established.

By default the vulnerable interface sits on the local network, so a stranger on the internet can’t just poke it unless the owner has switched on remote/WAN management - a setting most people never touch, but some do for legitimate reasons like managing a router while away. If that’s been enabled, the router is exposed to anyone on the internet who finds it.

There is, as things stand, no vendor fix. Netis had not shipped a patch at the time of disclosure, and no evidence has emerged that this is being exploited in the wild - this is a researcher’s find, not an active-attack report.

One thing worth flagging for anyone chasing the “critical, 9.8” framing: the researcher’s own advisory lists the CVSS score as pending, awaiting formal publication by the CNA. Where the specific 9.8 figure has come from isn’t clear from the sources here, so treat that number as provisional rather than confirmed.

What to do about it

If you own or administer a Netis NX10, check whether remote/WAN management is switched on and turn it off if you don’t need it - that alone removes internet-facing exposure. Keep an eye on Netis’s support channels for a firmware update, since none has been confirmed yet. There’s no indication ordinary broadband customers using other manufacturers’ routers are affected.

The takeaway

This is a real, well-documented flaw with an unusually simple attack path, but it’s currently confined to one specific router model and firmware pair, with no sign of active exploitation and no confirmed fix yet. Worth acting on if you own the device; not a reason for anyone else to panic.