CVE-2026-36538

HIGH

Netis AC1200 Router NC21 V4.0.1.4296 - Hard-coded Root Credential in /etc/shadow.sample

Title source: llm

Description

Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authenticate as root and gain full control of the underlying operating system.

References (2)

Core 2

Core References

http://netis-system.com

https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36538/readme.md

View Writeup ZIP pw:eip

Scores

CVSS v3 7.3

EPSS 0.0031

EPSS Percentile 22.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-798

Status published

Published May 27, 2026

Tracked Since May 27, 2026