The password and new_pwd_confirm parameters are passed directly to the OS shell without sanitization, allowing an attacker to embed shell commands in backticks and encode them in base64. This flaw enables arbitrary command execution when an HTTP POST request reaches the "/cgi-bin/skk_set.cgi" endpoint. The description explicitly notes that the endpoint requires no authentication, which means any device on the LAN can attempt the exploit and achieve full Remote Code Execution on the router’s operating system.

Netis AC1200 Router model NC21 running firmware version V4.0.1.4296 is affected. No other models or firmware versions are mentioned as having this vulnerability.

The CVSS score of 7.3 indicates a high severity risk. The EPSS score is reported as less than 1 %, implying that the probability of exploitation is very low in the current threat landscape, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP POST request sent from any LAN device to the "/cgi-bin/skk_set.cgi" endpoint; once the command is accepted, the attacker can run arbitrary shell commands, compromising the router’s firmware and potentially any devices connected through it.