CVE-2021-26747: Netis router ping command shell metacharacter injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable command injection with a 9.8 CVSS score and high EPSS probability makes this an urgent patching priority.

What it is

Netis WF2780 and WF2411 firmware pass unsanitized input into the ping command, allowing shell metacharacter injection. Because the flaw is reachable over the network with no authentication, it exposes affected routers to remote code execution.

Impact

An unauthenticated remote attacker can execute arbitrary shell commands on the device, gaining full control of the router and its network position.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:N, so the ping functionality is reachable over the network with no authentication and no user interaction.

Exploitation

CVE-2021-26747 is not listed in CISA KEV, but EPSS is 0.54777 (98.9th percentile) and public exploit code is referenced on GitHub, indicating meaningful exploitation activity.

What to do

• Apply the latest Netis firmware for WF2780 and WF2411; if no fixed release exists, replace or retire the devices.
• Disable remote administration and restrict the router management interface to trusted LAN segments only.
• Block external access to the router web/ping interface at the network perimeter.
• Segment or isolate affected routers so a compromise cannot pivot into other network assets.
• Monitor vendor advisories for updated firmware since the record does not specify fixed versions.

Detection

• Inspect router and perimeter logs for ping requests containing shell metacharacters such as ;, |, &, $, or backticks.
• Alert on unexpected outbound connections or processes originating from router management IPs.
• Review router configuration changes and new accounts for signs of post-exploitation.
• Use network monitoring to detect anomalous traffic from affected Netis devices to external hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.