The vulnerability exposes a public CGI endpoint, /cgi-bin/skk_get.cgi, that returns the entire router configuration as JSON without requiring any authentication. This payload includes administrator credentials, WiFi passwords, PPPoE credentials, DDNS credentials, and a complete mapping of all devices connected to the network. The result is a classic information disclosure flaw (CWE-200) that allows an attacker to obtain highly privileged credentials and detailed network topology.

Netis AC1200 Router NC21 running firmware version 4.0.1.4296 is affected.

The exploit is local; any device on the LAN can issue a single HTTP GET request to the endpoint and trigger the disclosure. The CVSS score of 7.3 indicates high severity, but the EPSS score of less than 1% reflects a low probability of exploitation at present. Because the underlying firmware does not address the flaw, the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential for credential compromise and lateral movement remains significant.