Remote Backdoor Vulnerability in Netis EAP930

A security vulnerability (CVE-2026-112360) has been identified in the Netis EAP930 wireless access point, specifically within firmware version 1.250905.115454. The flaw exists within the return200 function of the /cgi-bin/debug CGI endpoint. Attackers can reach this endpoint remotely and manipulate the SIGNATURE argument to inject and execute a backdoor on the device. While the vulnerability requires a high degree of complexity to exploit successfully, it represents a significant risk to the integrity of affected network infrastructure. The vendor, Netis, was notified of this vulnerability prior to disclosure but did not provide a response or a patch, leaving devices currently running this firmware version in a vulnerable state.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain unauthorized access to the affected Netis EAP930 devices. By establishing a backdoor, attackers could potentially intercept network traffic, pivot into internal network segments, or maintain persistent access to the enterprise or residential environment. As the vulnerability is remote and the vendor has not provided a security update, all deployed EAP930 devices running version 1.250905.115454 are at risk of compromise.

Recommendation

1. Inventory all instances of Netis EAP930 hardware within the environment to identify devices running firmware version 1.250905.115454.
2. Restrict network access to the management interface and CGI endpoints of all Netis EAP930 devices to known, trusted management subnets via firewall rules.
3. Given the lack of a vendor patch, consider isolating affected devices from the internal network until a secure firmware version is released or compensating controls are implemented.
4. Monitor web server and firewall logs for unusual POST or GET requests targeting the /cgi-bin/debug endpoint with non-standard values in the SIGNATURE parameter.