The Netis AC1200 Router NC21 firmware version 4.0.1.4296 is vulnerable to unauthenticated command injection through the /cgi-bin/skk_set.cgi endpoint. Specifically, the password and new_pwd_confirm POST parameters are directly passed to the underlying operating system shell without proper input sanitization. Attackers can inject arbitrary shell commands by encoding them in base64 and wrapping them in backticks (`). Since the endpoint does not require authentication, any device on the local network can exploit this vulnerability to achieve full remote code execution on the router's OS with a single HTTP POST request. This vulnerability is tracked as CVE-2026-36540 and is associated with CWE-77 (Improper Neutralization of Special Elements used in a Command).

Successful exploitation allows an unauthenticated attacker on the local network to execute arbitrary commands on the router's operating system, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the device, potentially allowing control over network traffic and device configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict LAN access to trusted devices only and consider isolating the router management interface from untrusted local devices. Monitor vendor communications for official patches or updates addressing this vulnerability.