The Netis AC1200 Router NC21 firmware version 4.0.1.4296 exposes a critical information disclosure vulnerability via the /cgi-bin/skk_get.cgi endpoint. This endpoint returns the entire router configuration, including sensitive credentials and network topology, without requiring any authentication. An attacker with LAN access can exploit this by issuing a simple HTTP GET request, thereby gaining access to administrator and user credentials and detailed network information. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity. No official patch or remediation guidance is currently documented.

An attacker on the local network can retrieve highly sensitive information including administrator credentials, WiFi passwords, PPPoE credentials, DDNS credentials, and a full map of connected devices. This exposure can lead to unauthorized administrative access, network compromise, and further exploitation within the affected network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the local network to trusted users only and consider isolating the router management interface from untrusted LAN segments. Monitor vendor communications for updates regarding patches or official mitigations.