CVE-2026-73673

Name of the Vulnerable Software and Affected Versions Netis NC63 version V3.0.0.3327

Description An authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher allows unauthenticated attackers to upload unsigned firmware images. The Boa web server grants access to any path containing .cgi without requiring a valid session cookie, and the netis.cgi dispatcher fails to enforce the authentication state before triggering the firmware update handler. The system validates firmware images using static product strings and a forgeable additive checksum instead of a cryptographic signature, which could lead to persistent compromise of the router. This is exploited by sending a multipart POST request to the '/cgi-bin/upload fw.cgi' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.