CVE-2026-73673: Netis NC63 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Original vulnerability research by Özcan Ersan (@ozcanpng).
This repository documents CVE-2026-73673, discovered and reported by the author.

Non-destructive proof-of-concept and evidence package for CVE-2026-73673.

Netis NC63 firmware V3.0.0.3327 exposes the privileged firmware-update endpoint /cgi-bin/upload_fw.cgi without enforcing an authenticated administrator session. The uploaded firmware path also lacks sufficient cryptographic firmware authentication for firmware supplied to the updater.

Affected Product

Vendor firmware page:

https://www.netis-systems.com/support/downinfo.html?id=35

Vulnerability Chain

Unauthenticated HTTP client
  |
  | POST /cgi-bin/upload_fw.cgi
  | multipart/form-data field: update
  v
Boa
  |
  | broad ".cgi" authorization branch
  v
/bin/netis.cgi
  |
  | reads /tmp/boa_auth but does not enforce it before dispatch
  v
FUN_004144dc
  |
  | cr6c header, checksum, and NC63/NETISVC product tag checks
  v
RunSystemCmd("fwd <shmid> <size> ...")
  v
/bin/fwd
  |
  v
open("/dev/mtdblock0", O_RDWR)

The included PoC uses a 30-byte non-bootable validation container. It is intended to demonstrate that an unauthenticated request reaches firmware validation and the updater path in an isolated runtime. It is not a replacement firmware image.

Classification

Suggested primary weaknesses:

• CWE-306: Missing Authentication for Critical Function
• CWE-494: Download of Code Without Integrity Check

Suggested CVSS v3.1:

8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This score assumes the typical deployment in which the router management interface is reachable from the adjacent local network. Deployments exposing the management interface over a routed or WAN-accessible network may warrant a different Attack Vector assessment.

Repository Contents

poc/
  make-probe.sh
  request.sh
  probe-cr6c-valid-checksum.bin

evidence/
  screenshots/
  traces/
  SHA256SUMS

docs/
  REPRODUCTION.md
  SAFETY.md
  DISCLOSURE.md

This repository does not include vendor firmware images, extracted root filesystems, original device binaries, a Ghidra project, or a bootable replacement firmware image.

References

• Technical write-up: https://ozcanpng.dev/blog/cve-2026-73673-netis-nc63-unauthenticated-firmware-update/
• Turkish write-up: https://ozcanpng.dev/blog/tr/cve-2026-73673-netis-nc63-unauthenticated-firmware-update/
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-73673
• Vendor firmware page: https://www.netis-systems.com/support/downinfo.html?id=35

Researcher

Özcan Ersan (@ozcanpng)