CVE-2024-22729: NETIS MW5360 router command injection in login password parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command injection with CVSS 9.8 and very high EPSS makes this an urgent patch-or-isolate case.

What it is

NETIS SYSTEMS MW5360 firmware V1.0.1.3031 contains a command injection flaw in the password parameter on the login page. Because the parameter is passed to a shell without sanitization, an unauthenticated remote attacker can execute arbitrary commands on the device. The record does not list additional affected firmware versions beyond V1.0.1.3031.

Impact

An attacker gains arbitrary command execution on the router, which can lead to full device compromise, credential theft, and use of the device as a foothold into the internal network. With CVSS 9.8 across confidentiality, integrity and availability, the impact is total for the affected device.

Attack surface

The flaw is reachable over the network through the login page password parameter, per the CVSS vector AV:N/PR:N/UI:N, so no authentication or user interaction is required. Any host that can reach the router's web interface can attempt the injection.

Exploitation

A public exploit reference exists (tagged Exploit and Third Party Advisory), and EPSS is 0.70779 at the 99.367th percentile, indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, and no ransomware groups are documented using it.

What to do

• Apply the vendor firmware update for MW5360 if one is available; the record does not name a fixed version, so confirm with NETIS support.
• If no patch exists, restrict access to the router web interface to trusted management networks and disable remote/WAN administration.
• Place the device behind a firewall or management VLAN so the login page is not reachable from untrusted networks.
• Replace end-of-support or unpatchable units with a supported router.
• Monitor vendor advisories for a fixed firmware release.

Detection

• Inspect web server and router logs for login requests whose password parameter contains shell metacharacters such as ;, |, $(), or backticks.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Watch for repeated login-page requests from a single source, which may indicate injection probing.
• Baseline normal login traffic and flag password values that deviate from expected credential formats.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.