| عنوان | Neterbit NW-431F 20250715 Information Disclosure / Missing Authentication (CWE-200, CWE-30 |
|---|
| الوصف | Description:
The embedded web server of the Neterbit NW-431F LTE router exposes the
endpoint /sms.json without any authentication. Any unauthenticated remote
attacker able to reach the web interface (LAN, or WAN when remote management
is enabled) can retrieve the full SMS inbox as a JSON document. The response
contains sender phone numbers, message timestamps, and complete message
bodies, exposing sensitive data such as 2FA/OTP codes, banking alerts, and
private correspondence.
Proof of Concept:
GET /sms.json HTTP/1.1
Host: <router-ip>
Response: HTTP/1.1 200 OK, Content-Type: application/json
Sample (redacted):
{"list":{"inbox":[{"id":"1","sender":"9891***","mms_index":"0",
"time":"26072010434114","content":"..."}], ...}}
Verified on: HW V1, firmware NW-431F-20250715-IR04
Additional observation: requests to other JSON endpoints
(e.g. /version_info.json, /system_status.json) cause the embedded HTTP
server to terminate connections abruptly, indicating further robustness
issues in the web stack.
Discovery / Disclosure dates:
Discovery date: 2026-08-26
Vendor contact: 2026-08-26 via [email protected]
→ delivery failed, vendor MX/mail DNS misconfigured
(mail.neterbit.com NXDOMAIN); bounce logs retained.
Vendor remains unreachable — no security contact found.
Public disclosure: planned ~2026-11-24 (90-day coordinated disclosure
from initial contact attempt)
Researcher credit:
Libssl — Independent Security Researcher
https://github.com/KernelDotDLL · https://libssl.dev |
|---|
| المستخدم | libssl (UID 100952) |
|---|
| ارسال | 02/09/2026 06:01 AM (1 شهر منذ) |
|---|
| الاعتدال | 10/10/2026 05:51 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416235 [Neterbit NW-431F 20250715 Embedded Web Server /sms.json الكشف عن المعلومات] |
|---|
| النقاط | 17 |
|---|