CVE-2026-112360: Netis EAP930 CGI Endpoint debug return200 backdoor

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-20
Weakness: CWE-912

Description

A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Netis EAP930: 1.250905.115454

References

https://vuldb.com/cve/CVE-2026-112360
https://vuldb.com/submit/990050
https://vuldb.com/vuln/422394
https://vuldb.com/vuln/422394/cti

Get alerted when CVE-2026-112360 or the next vulnerability affects your stack