CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated administrators of Netis NX10 firmware versions 4.0.1.5808 and 3.0.0.4142 to execute arbitrary shell commands as root due to an OS command injection flaw in the ping diagnostic handler. This issue arises from inadequate input validation of the IpAddr parameter, which permits command substitution and other forms of exploitation. Organizations using these firmware versions should prioritize remediation to prevent potential unauthorized access and control over their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available for exploitation.