Netis vulnerabilities

12 vulnerabilities

Known vulnerabilities in Netis products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.

Products

8
RoutineCVE-2026-112360netis · eap930Netis EAP930 CGI Endpoint debug return200 backdoorA security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.CVSS8.9HighEPSS0.48%RoutineCVE-2026-108898netis · wf2409eNetis WF2409E Wireless Settings cross site scriptingA vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS5.1MediumEPSS0.19%RoutineCVE-2025-9119netis · wf2419Netis WF2419 Wireless Settings index.htm cross site scriptingA vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Page. This manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.CVSS4.8MediumEPSS0.27%PrioritiseCVE-2025-34117netcore technology · router firmware +1 moreNetcore / Netis Routers RCE via UDP Port 53413 BackdoorA remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.CVSS9.3CriticalEPSS20.77%RoutineCVE-2025-2922netis · wf-2404Netis WF-2404 BusyBox Shell cleartext storageA vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS2.0LowEPSS0.13%RoutineCVE-2025-2921netis · wf-2404 +1 moreNetis WF-2404 passwd default passwordA vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS6.4MediumEPSS0.36%RoutineCVE-2025-2920netis · wf-2404Netis WF-2404 passwd weak hashA vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS2.0LowEPSS0.13%PrioritiseCVE-2025-2919netis · wf-2404 +1 moreNetis WF-2404 UART hardware allows activation of test or debug logic at runtimeA vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.2HighEPSS0.38%RoutineCVE-2025-1617netis · wf2780Netis WF2780 Wireless 2.4G Menu cross site scriptingA vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.CVSS4.8MediumEPSS0.31%PrioritiseCVE-2018-25069netis · netcore router +1 moreNetis Netcore Router hard-coded passwordA vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.CVSS9.8CriticalEPSS0.90%RoutineCVE-2023-0114netis · netcore router +1 moreNetis Netcore Router Backup param.file.tgz cleartext storage in a file or on diskA vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.CVSS5.5MediumEPSS0.15%RoutineCVE-2023-0113netis · netcore router +1 moreNetis Netcore Router Backup param.file.tgz information disclosureA vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.CVSS7.5HighEPSS0.81%