Netis NC63 routers running firmware V3.0.0.3327 allow an unauthenticated attacker to upload firmware images without proper authentication. The vulnerability arises from the Boa web server granting access to any ".cgi" path without checking for a valid session cookie, and the netis.cgi dispatcher failing to enforce authentication prior to initiating the firmware update. Because the update handler relies only on a forgeable additive checksum and static product strings, an attacker can submit a malicious firmware image that the router will accept and flash, potentially gaining persistent control over the device.

Affected systems include Netis Systems Co., Ltd’s NC63 Wireless AC1200 router, specifically firmware version V3.0.0.3327 and earlier builds that use the same web server and CGI dispatcher logic. The vulnerability is tied to the router’s web interface exposed on the default port and the upload_fw.cgi endpoint, so any device with that firmware installed and an accessible web shell is vulnerable.

The CVSS score of 8.7 categorises the issue as Critical, and although an EPSS score is not available, the absence of a KEV listing does not diminish the risk, as attackers can exploit the flaw over the network by submitting a multipart POST request to /cgi-bin/upload_fw.cgi from any client that can reach the router’s web interface. The flaw permits unauthenticated firmware uploads that bypass normal cryptographic checks, giving attackers code execution or remote persistence. The lack of authentication enforcement makes the vulnerability trivial to exploit once network reachability is achieved.