CVE-2025-67448: Neterbit NW-431F Router SMS Stored XSS Vulnerability (CVSS 7.1)

Technical summary

The vulnerability is a classic stored XSS (CWE-79) in the router's web-based SMS interface. The router receives SMS messages and stores them in a database or filesystem without sanitizing HTML or JavaScript characters. When the administrative or user interface renders stored SMS messages for display, the malicious payload is executed in the browser with the privileges of the logged-in session. The CVSS 3.1 score of 7.1 (HIGH) reflects the network attack vector (AV:N), low attack complexity (AC:L), lack of privilege requirements (PR:N), but requirement for user interaction (UI:R) to view the message and the high confidentiality impact (C:H). The integrity impact is limited (I:L) since the attacker cannot directly modify server state, and there is no availability impact.

Business impact

Routers are often deployed in small offices, retail locations, and branch operations where they serve as critical network chokepoints. Compromise of a router's SMS or administrative interface can lead to unauthorized access to network resources, interception of communications, or lateral movement into connected systems. An attacker leveraging this vulnerability could steal credentials visible in the interface, capture browser session tokens, or redirect users to phishing sites when they attempt to manage the router. For organizations relying on this model for remote management or SMS-based notifications, the impact includes loss of confidentiality of sensitive network configuration data and potential integrity issues if credentials are harvested.

Affected systems

Neterbit NW-431F routers with firmware version 20241014-IR03 and all earlier versions are affected. Organizations using this specific router model for network access or IoT gateway functionality should verify their firmware version in the device settings or management interface. The vendor or product distribution channel should be consulted for a definitive list of all affected firmware revisions, as the advisory states 'and before' without specifying the earliest affected version.

Exploitability

Exploitation requires the attacker to send an SMS to the router and the victim to view that message through the web interface—a reasonably achievable scenario in environments where router SMS features are actively used for alerting or two-factor authentication. The network-accessible attack vector and lack of authentication requirement for sending SMS (if the router accepts external messages) lower the barrier further. However, the requirement for user interaction (viewing the message) means this is not a worm-like vulnerability that spreads automatically. Exploit code is not known to be publicly available, and the vulnerability is not tracked on CISA's Known Exploited Vulnerabilities list, reducing immediate threat likelihood—but organizations should not interpret this as a signal to delay patching.

Remediation

The primary remediation is to update the Neterbit NW-431F firmware to a patched version released after 20241014-IR03. Customers should verify the availability of a firmware update from Neterbit and apply it to all affected devices. Interim mitigation measures include disabling the SMS module in the router's settings if it is not actively required, restricting access to the router's web interface to trusted IP addresses via access control lists, and monitoring SMS logs for unexpected or suspicious messages containing special characters or script-like content.

Patch guidance

Contact Neterbit support or check the vendor's security advisory page for the latest firmware version addressing CVE-2025-67448. Firmware updates for router devices should be applied during a maintenance window to avoid network interruption. Before deploying to production, test the update on a non-critical device or in a lab environment to confirm compatibility with your network configuration. Document the firmware version after patching to streamline future vulnerability assessments.

Detection guidance

Monitor router SMS logs for messages containing HTML tags (< or >), JavaScript keywords (script, onclick, onerror, onload), or other encoded variations that might indicate payload delivery. Look for unusual patterns in SMS sender identities or timestamps. If you have access to web server or application logs, search for POST requests to SMS viewing or retrieval endpoints with encoded or obfuscated payloads. Network-based detection is limited unless the router exports logs to a SIEM; in that case, define alerts for XSS-like patterns in SMS message fields.

Why prioritize this

This vulnerability merits prompt attention despite a lack of known active exploitation. The HIGH CVSS score reflects the sensitive nature of router administration interfaces and the potential for lateral movement. The attack is feasible in real-world scenarios where routers process incoming SMS (e.g., 4G/LTE routers, IoT gateways). Organizations should prioritize patching within 30 days, sooner if the router is internet-facing or handles critical network functions. The fact that it is not yet on the KEV list should not delay action—KEV inclusion is not a prerequisite for real-world risk.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) balances several factors: network accessibility and no authentication requirement support a high score, but the UI:R (user interaction) requirement prevents a critical rating. The high confidentiality impact reflects the sensitivity of credentials and session tokens stored in router interfaces. The limited integrity impact (I:L) acknowledges that the attacker cannot directly alter router configuration or network state through XSS alone, though session hijacking could enable further actions. The zero availability impact is correct—the vulnerability does not cause denial of service.

Frequently asked questions