| 标题 | Neterbit NW-431F 20250715 Information Disclosure / Missing Authentication (CWE-200, CWE-30 |
|---|
| 描述 | Description:
The embedded web server of the Neterbit NW-431F LTE router exposes the
endpoint /sms.json without any authentication. Any unauthenticated remote
attacker able to reach the web interface (LAN, or WAN when remote management
is enabled) can retrieve the full SMS inbox as a JSON document. The response
contains sender phone numbers, message timestamps, and complete message
bodies, exposing sensitive data such as 2FA/OTP codes, banking alerts, and
private correspondence.
Proof of Concept:
GET /sms.json HTTP/1.1
Host: <router-ip>
Response: HTTP/1.1 200 OK, Content-Type: application/json
Sample (redacted):
{"list":{"inbox":[{"id":"1","sender":"9891***","mms_index":"0",
"time":"26072010434114","content":"..."}], ...}}
Verified on: HW V1, firmware NW-431F-20250715-IR04
Additional observation: requests to other JSON endpoints
(e.g. /version_info.json, /system_status.json) cause the embedded HTTP
server to terminate connections abruptly, indicating further robustness
issues in the web stack.
Discovery / Disclosure dates:
Discovery date: 2026-08-26
Vendor contact: 2026-08-26 via [email protected]
→ delivery failed, vendor MX/mail DNS misconfigured
(mail.neterbit.com NXDOMAIN); bounce logs retained.
Vendor remains unreachable — no security contact found.
Public disclosure: planned ~2026-11-24 (90-day coordinated disclosure
from initial contact attempt)
Researcher credit:
Libssl — Independent Security Researcher
https://github.com/KernelDotDLL · https://libssl.dev |
|---|
| 用户 | libssl (UID 100952) |
|---|
| 提交 | 2026-09-02 06時01分 (1 月前) |
|---|
| 管理 | 2026-10-10 17時51分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416235 [Neterbit NW-431F 20250715 Embedded Web Server /sms.json 信息公开] |
|---|
| 积分 | 17 |
|---|