How to fix CVE-2025-2920?

During next maintenance window: Apply vendor patches when convenient. Verify weak cryptography controls are in place.

Is Netis WF-2404 affected by CVE-2025-2920?

CVE-2025-2920 is a low-severity vulnerability in A vulnerability involving weak cryptography (CVSS 1.0). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Netis WF-2404 CVE-2025-2920

LOW

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2025-03-28 [email protected]

Information Disclosure

1.0

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

CVE Published

Mar 28, 2025 - 18:15 nvd

LOW 1.0

DescriptionNVD

A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A vulnerability was found in Netis WF-2404 1.1.124EN. Rated low severity (CVSS 1.0), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-327. A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2025-2920 vulnerability details – vuln.today

Back