Attack Chain

1. Attacker performs reconnaissance to identify the target Netis NC63 router and confirms the firmware version V3.0.0.3327.
2. Attacker crafts a multipart POST request targeting the /cgi-bin/upload_fw.cgi endpoint.
3. The request is sent to the target device without a valid session cookie.
4. The Boa web server processes the request, bypassing authentication checks due to the '.cgi' extension.
5. The netis.cgi CGI dispatcher accepts the request and passes it to the internal firmware update handler.
6. The firmware update handler verifies the forged additive checksum and static strings, failing to perform cryptographic signature validation.
7. The router processes and writes the malicious firmware image to flash memory.
8. Upon reboot, the malicious firmware executes, granting the attacker persistent administrative control over the router.

Impact

Successful exploitation allows for the permanent compromise of the Netis NC63 router. As a network edge device, a compromised router can be used to facilitate man-in-the-middle attacks, intercept traffic, exfiltrate sensitive data, or serve as a persistent foothold for lateral movement into the local area network.

Recommendation

• Immediately restrict administrative access to the router web interface to trusted management IPs only.
• Disable remote management on all internet-facing interfaces.
• Monitor network logs for multipart POST requests directed at /cgi-bin/upload_fw.cgi.
• Check the Netis official support portal for firmware patches addressing CVE-2026-73673 and update all affected devices.