| Title | Neterbit NW-431F 20250715 Information Disclosure / Missing Authentication (CWE-200, CWE-30 |
|---|
| Description | Description:
The embedded web server of the Neterbit NW-431F LTE router exposes the
endpoint /sms.json without any authentication. Any unauthenticated remote
attacker able to reach the web interface (LAN, or WAN when remote management
is enabled) can retrieve the full SMS inbox as a JSON document. The response
contains sender phone numbers, message timestamps, and complete message
bodies, exposing sensitive data such as 2FA/OTP codes, banking alerts, and
private correspondence.
Proof of Concept:
GET /sms.json HTTP/1.1
Host: <router-ip>
Response: HTTP/1.1 200 OK, Content-Type: application/json
Sample (redacted):
{"list":{"inbox":[{"id":"1","sender":"9891***","mms_index":"0",
"time":"26072010434114","content":"..."}], ...}}
Verified on: HW V1, firmware NW-431F-20250715-IR04
Additional observation: requests to other JSON endpoints
(e.g. /version_info.json, /system_status.json) cause the embedded HTTP
server to terminate connections abruptly, indicating further robustness
issues in the web stack.
Discovery / Disclosure dates:
Discovery date: 2026-08-26
Vendor contact: 2026-08-26 via [email protected]
→ delivery failed, vendor MX/mail DNS misconfigured
(mail.neterbit.com NXDOMAIN); bounce logs retained.
Vendor remains unreachable — no security contact found.
Public disclosure: planned ~2026-11-24 (90-day coordinated disclosure
from initial contact attempt)
Researcher credit:
Libssl — Independent Security Researcher
https://github.com/KernelDotDLL · https://libssl.dev |
|---|
| User | libssl (UID 100952) |
|---|
| Submission | 09/02/2026 06:01 (1 month ago) |
|---|
| Moderation | 10/10/2026 17:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416235 [Neterbit NW-431F 20250715 Embedded Web Server /sms.json information disclosure] |
|---|
| Points | 17 |
|---|