CVE-2026-61516: Insufficiently Protected Credentials in Netis Systems NX10
Description
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session on the device.
CVSS v4.0
Score 9.3critical
Affected software
Netis Systems
NX10
pkg:github/netis-systems/nx10Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-61516 is an information disclosure vulnerability in Netis NX10 firmware versions 4.0.1.5808 and 3.0.0.4142. The flaw allows unauthenticated attackers to send a request to the sysinfo action in the device's web management interface and retrieve the administrator password without needing a valid session. The attacker can then use the exposed credentials to authenticate as an administrator, gaining full control over the device.
Potential Impact
An attacker can fully compromise the affected Netis NX10 devices by obtaining administrator credentials without authentication. This leads to complete administrative control over the device, potentially allowing configuration changes, network manipulation, or further attacks within the network environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface to trusted networks only and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-10T15:43:36.627Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa01dbbacd9273b49c83716
Added to database: 09/08/2026, 14:37:47 UTC
Last enriched: 09/19/2026, 22:18:18 UTC
Last updated: 10/24/2026, 03:05:10 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.