{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/eap930-1.250905.115454/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netis:eap930:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-112360"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EAP930 (1.250905.115454)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","network-infrastructure"],"_cs_type":"advisory","_cs_vendors":["Netis"],"content_html":"\u003cp\u003eA security vulnerability (CVE-2026-112360) has been identified in the Netis EAP930 wireless access point, specifically within firmware version 1.250905.115454. The flaw exists within the return200 function of the /cgi-bin/debug CGI endpoint. Attackers can reach this endpoint remotely and manipulate the SIGNATURE argument to inject and execute a backdoor on the device. While the vulnerability requires a high degree of complexity to exploit successfully, it represents a significant risk to the integrity of affected network infrastructure. The vendor, Netis, was notified of this vulnerability prior to disclosure but did not provide a response or a patch, leaving devices currently running this firmware version in a vulnerable state.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated remote attacker to gain unauthorized access to the affected Netis EAP930 devices. By establishing a backdoor, attackers could potentially intercept network traffic, pivot into internal network segments, or maintain persistent access to the enterprise or residential environment. As the vulnerability is remote and the vendor has not provided a security update, all deployed EAP930 devices running version 1.250905.115454 are at risk of compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of Netis EAP930 hardware within the environment to identify devices running firmware version 1.250905.115454.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the management interface and CGI endpoints of all Netis EAP930 devices to known, trusted management subnets via firewall rules.\u003c/li\u003e\n\u003cli\u003eGiven the lack of a vendor patch, consider isolating affected devices from the internal network until a secure firmware version is released or compensating controls are implemented.\u003c/li\u003e\n\u003cli\u003eMonitor web server and firewall logs for unusual POST or GET requests targeting the /cgi-bin/debug endpoint with non-standard values in the SIGNATURE parameter.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T00:30:47Z","date_published":"2026-10-20T00:30:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netis-eap930-backdoor/","summary":"A vulnerability in the Netis EAP930 CGI endpoint allows remote attackers to trigger a backdoor via crafted manipulation of the SIGNATURE argument in the /cgi-bin/debug file.","title":"Remote Backdoor Vulnerability in Netis EAP930","url":"https://feed.craftedsignal.io/briefs/2026-10-netis-eap930-backdoor/"}],"language":"en","title":"CraftedSignal Threat Feed - EAP930 (1.250905.115454)","version":"https://jsonfeed.org/version/1.1"}