Search
Find a vulnerability
Search criteria
2 vulnerabilities found for EAP930 by Netis
CVE-2026-112360 (GCVE-0-2026-112360)
Vulnerability from nvd – Published: 2026-10-19 21:30 – Updated: 2026-10-20 16:09
VLAI
EPSS
VEX
Title
Netis EAP930 CGI Endpoint debug return200 backdoor
Summary
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:16 UTC
CWE
- CWE-912 - Backdoor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422394 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422394/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112360 | third-party-advisory |
| https://vuldb.com/submit/990050 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:16:16.413594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:09:08.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netis:eap930:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Endpoint"
],
"product": "EAP930",
"vendor": "Netis",
"versions": [
{
"status": "affected",
"version": "1.250905.115454"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "arpe1618 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:30:19.739Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422394 | Netis EAP930 CGI Endpoint debug return200 backdoor",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422394"
},
{
"name": "VDB-422394 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422394/cti"
},
{
"name": "CVE-2026-112360 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112360"
},
{
"name": "Submit #990050 | Netis Systems (Netcore Group) EAP930 (AX3000 Wireless Gigabit Ceiling Mount Access Point) V0.1.250905.115454 (CWE-912, CWE-798-adjacentm CWE-256/522)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/990050"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T16:57:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "Netis EAP930 CGI Endpoint debug return200 backdoor",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112360",
"datePublished": "2026-10-19T21:30:19.739Z",
"dateReserved": "2026-10-19T14:52:32.895Z",
"dateUpdated": "2026-10-20T16:09:08.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112360 (GCVE-0-2026-112360)
Vulnerability from cvelistv5 – Published: 2026-10-19 21:30 – Updated: 2026-10-20 16:09
VLAI
EPSS
VEX
Title
Netis EAP930 CGI Endpoint debug return200 backdoor
Summary
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:16 UTC
CWE
- CWE-912 - Backdoor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422394 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422394/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112360 | third-party-advisory |
| https://vuldb.com/submit/990050 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:16:16.413594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:09:08.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netis:eap930:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Endpoint"
],
"product": "EAP930",
"vendor": "Netis",
"versions": [
{
"status": "affected",
"version": "1.250905.115454"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "arpe1618 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:30:19.739Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422394 | Netis EAP930 CGI Endpoint debug return200 backdoor",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422394"
},
{
"name": "VDB-422394 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422394/cti"
},
{
"name": "CVE-2026-112360 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112360"
},
{
"name": "Submit #990050 | Netis Systems (Netcore Group) EAP930 (AX3000 Wireless Gigabit Ceiling Mount Access Point) V0.1.250905.115454 (CWE-912, CWE-798-adjacentm CWE-256/522)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/990050"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T16:57:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "Netis EAP930 CGI Endpoint debug return200 backdoor",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112360",
"datePublished": "2026-10-19T21:30:19.739Z",
"dateReserved": "2026-10-19T14:52:32.895Z",
"dateUpdated": "2026-10-20T16:09:08.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}