CVE-2026-112360
Netis EAP930 CGI Endpoint debug return200 backdoor
- State
- Published
- Severity
- 8.9 High
- Published
- Oct 19, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 19, 2026
Description
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.9 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.0 High | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.8 Medium | AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-912 Backdoor
Affected Products
| Product | Versions |
|---|---|
EAP930Netis |
|
References
- VDB-422394 | Netis EAP930 CGI Endpoint debug return200 backdoorvdb-entrytechnical-description
- VDB-422394 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-112360 | CVE Analysis and Reportthird-party-advisory
- Submit #990050 | Netis Systems (Netcore Group) EAP930 (AX3000 Wireless Gigabit Ceiling Mount Access Point) V0.1.250905.115454 (CWE-912, CWE-798-adjacentm CWE-256/522)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.