An OS command injection flaw exists in the ping diagnostic handler of Netis NX10 firmware. The IpAddr parameter is passed directly to a shell command through system() without adequate sanitization. The incomplete denylist only removes spaces, pipes, semicolons, and ampersands, leaving command substitution and alternate field separator expansion available. The flaw allows an authenticated administrator to execute arbitrary shell commands with root privileges, effectively granting full control over the device, including data exfiltration, persistence, and service disruption.

Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142.

The vulnerability has a CVSS score of 8.6. The EPSS score is not available. It is not listed in the CISA KEV catalog. The attack requires authenticated administrator privileges and is therefore restricted to users with privileged access. The likely attack vector is via the web interface or API that exposes the ping diagnostic endpoint, where the unsanitized IpAddr parameter can be injected. The high severity score and the need for privileged access indicate a significant risk if not mitigated.