CVE-2026-73673 describes an unauthenticated firmware update vulnerability in Netis NC63 router firmware V3.0.0.3327. The Boa web server grants access to any URL containing '.cgi' without enforcing session cookie validation, and the netis.cgi dispatcher reads but does not enforce authentication before invoking the firmware update handler at /cgi-bin/upload_fw.cgi. Attackers can submit multipart POST requests to upload firmware images that are only validated by a forgeable additive checksum and static product strings rather than cryptographic signatures. This flaw enables attackers to bypass authentication and potentially install malicious firmware, leading to persistent compromise of the device.

An unauthenticated attacker can upload arbitrary firmware to the affected router, bypassing authentication controls. This can lead to persistent compromise of the device, allowing attackers to execute arbitrary code, disrupt network operations, or use the router as a foothold for further attacks. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, reflecting its ease of exploitation without privileges or user interaction and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interface from untrusted networks and monitor for unusual firmware update attempts. Avoid exposing the router's web management interface to the internet. Follow vendor communications for updates on patches or official mitigations.