CVE-2025-2921: Netis WF-2404 passwd default password
Vulnerability summary
CVE-2025-2921 is a medium (CVSS 6.4) Use of Default Password vulnerability in netis-systems netis_wf-2404_firmware. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.4, physical access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 28-03-2025PublishedVulnerability first disclosed.
- 28-03-2025Last modifiedVulnerability information updated.
Description
A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.4MediumCVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.4MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.2MediumAV:L/AC:H/Au:N/C:C/I:C/A:C
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.35% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (scoozi.substack.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: physical access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netis1 product
- wf-24041.1.124EN
Netis-systems1 product
- netis_wf-2404_firmware1.1.124en
2 vendors · 2 products