CVE-2026-61516 affects Netis Systems NX10 routers running firmware versions 4.0.1.5808 and 3.0.0.4142. The vulnerability arises from insufficient protection of credentials in the device's web management interface. Specifically, unauthenticated attackers can send a request to the sysinfo action endpoint without a valid session and retrieve the administrator password. This password can then be replayed against the login handler to establish a fully authenticated administrator session, compromising device security. No official patch or remediation guidance has been provided as of the publication date.

An attacker can gain unauthorized administrative access to the affected Netis NX10 devices by retrieving and replaying the administrator password without authentication. This compromises the confidentiality and integrity of the device, potentially allowing full control over the router's configuration and network traffic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's web management interface to trusted networks only and monitor for unauthorized access attempts.