Unauthenticated Firmware Update Vulnerability in Netis NC63 Routers

Netis NC63 router firmware version V3.0.0.3327 contains a critical vulnerability (CVE-2026-73673) that allows unauthenticated remote attackers to upload malicious firmware images to the device. The vulnerability stems from improper authentication enforcement within the Boa web server and the netis.cgi CGI dispatcher. The web server incorrectly allows access to any path containing '.cgi' without validating session cookies. Furthermore, the netis.cgi dispatcher invokes the firmware update handler without verifying the authentication state of the request. Because the firmware update process relies on a weak additive checksum and static product strings rather than cryptographic signature verification, an attacker can push unauthorized or malicious firmware to the device. This enables persistent, full control over the compromised router.

Attack Chain

1. Attacker performs reconnaissance to identify the target Netis NC63 router and confirms the firmware version V3.0.0.3327.
2. Attacker crafts a multipart POST request targeting the /cgi-bin/upload_fw.cgi endpoint.
3. The request is sent to the target device without a valid session cookie.
4. The Boa web server processes the request, bypassing authentication checks due to the '.cgi' extension.
5. The netis.cgi CGI dispatcher accepts the request and passes it to the internal firmware update handler.
6. The firmware update handler verifies the forged additive checksum and static strings, failing to perform cryptographic signature validation.
7. The router processes and writes the malicious firmware image to flash memory.
8. Upon reboot, the malicious firmware executes, granting the attacker persistent administrative control over the router.

Impact

Successful exploitation allows for the permanent compromise of the Netis NC63 router. As a network edge device, a compromised router can be used to facilitate man-in-the-middle attacks, intercept traffic, exfiltrate sensitive data, or serve as a persistent foothold for lateral movement into the local area network.

Recommendation

• Immediately restrict administrative access to the router web interface to trusted management IPs only.
• Disable remote management on all internet-facing interfaces.
• Monitor network logs for multipart POST requests directed at /cgi-bin/upload_fw.cgi.
• Check the Netis official support portal for firmware patches addressing CVE-2026-73673 and update all affected devices.