CVE-2025-67448: XSS
The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the context of the victim's browser when the message is viewed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Neterbit NW-431F SMS modulefrom your environment.Disable or uninstall the router's SMS module on affected Neterbit NW-431F devices if SMS functionality is not required to eliminate the attack surface for stored XSS in SMS messages.
- Compensating control
Until an official vendor patch is available, restrict access to the router's message-viewing/management interface (for example, limit to trusted administrative IP addresses) and/or filter/block incoming SMS content that contains HTML or JavaScript so malicious payloads are not stored or rendered.
- Operational
Advise administrators and users not to open or view SMS messages from untrusted sources on affected devices and monitor logs for suspicious SMS submissions or signs of XSS exploitation; apply vendor-provided updates as soon as they become available.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
Anyone who can send an SMS to the router can supply the malicious payload. Exploitation then requires a user to view the stored SMS message in the router's web interface, causing the payload to run in that user's browser context.
Which router versions are affected?
Neterbit NW-431F Router firmware 20241014-IR03 and earlier is identified as affected. The provided information does not state whether the SMS module is enabled or exposed in the default configuration.
How can administrators check for possible exposure or attempted exploitation?
Check stored SMS messages in the router's management interface for unexpected or suspicious content, particularly messages containing script-like markup or payloads. The supplied data does not provide a separate detection method or indicators of compromise.