EUVD-2026-96927
GHSA-8mgh-g28c-j96m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web server over network
-
ExploitRequest /sms.json endpoint unauthenticated
-
ExecutionServer returns restricted data
-
ImpactHarvest disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote unauthenticated access to the device's Embedded Web Server, specifically the /sms.json resource, with no user interaction. The practical limiting factor is exposure: the NW-431F management/web interface must be reachable by the attacker (e.g., exposed to the internet or on the same LAN), and impact is confined to disclosure of information returned by that endpoint, with no integrity or availability effect. No non-default configuration is documented as required. |
| Impact | This is a moderate, not urgent, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the only impact is low confidentiality (VC:L with VI:N/VA:N), reflecting CWE-200 information disclosure via the /sms.json endpoint rather than code execution or data tampering. No EPSS score, KEV listing, or POC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The sole source is VulDB, a disclosure aggregator, and the vendor did not respond, meaning there is no vendor-confirmed patch or advisory. Net: a genuinely remote-unauthenticated bug that is easy to trigger, but with limited blast radius (information leak only) on what appears to be a niche embedded device - real but low-priority unless the leaked data (the endpoint name /sms.json suggests SMS message content) is sensitive in a given deployment. Note the signals are not conflicting; they are simply thin - risk rests almost entirely on a single researcher submission with no corroboration. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends an HTTP request to the embedded web server's /sms.json endpoint on a reachable NW-431F device and receives information that should not be exposed, likely SMS-related data. No user interaction or authentication is needed, but impact is limited to disclosure of information. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated information disclosure affects Neterbit NW-431F devices (firmware build 20250715 and, per the wildcard CPE, presumably other unspecified versions) because the Embedded Web Server exposes the /sms.json resource without adequate access control. A remote attacker who can reach the device's web interface can retrieve information from that endpoint with no credentials and no user interaction, yielding a low-confidentiality impact only - no integrity or availability effect - consistent with an overall CVSS 4.0 base score of 6.9 (CVSS 3.1 equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vendor was notified early but did not respond, so no vendor-released patch has been identified, and no public exploit code or confirmed active exploitation was observed at time of analysis; the practical risk is driven by exposure rather than by exploitation tooling. This is a moderate, not urgent, issue.
RemediationAI
No vendor-released patch identified at time of analysis: Neterbit was contacted early about this issue and did not respond, and none of the supplied references point to a fixed firmware build, GitHub commit, or vendor advisory. Until a firmware update exists, treat the management interface as untrusted and apply layered compensating controls. First, remove internet exposure of the NW-431F web interface - block inbound access to the device's HTTP/HTTPS management ports at the perimeter firewall and require access through a VPN or a management jump host; the trade-off is that remote administration becomes dependent on the VPN/jump host being available. Second, if the platform supports it, restrict administrative access by source IP or bind the web UI to an internal management VLAN, accepting that any administrator outside that range loses direct access. Third, where the device allows it, disable the remote web management feature entirely and manage locally or via CLI/console; the cost is convenience and the need for on-site or out-of-band access. Fourth, apply egress and internal segmentation so that a compromised device leaking data from /sms.json cannot be trivially scraped by other hosts on the LAN. Fifth, monitor for requests to /sms.json from unexpected clients and for anomalous outbound traffic from the device, noting that such detection is best-effort given embedded devices usually lack robust logging. Because impact is confined to confidentiality, these exposure-reduction measures address the realistic risk without requiring emergency patching; re-check the VulDB entry (https://vuldb.com/vuln/416235) periodically for a vendor fix or updated disclosure details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is an Embedded Web Server running on the Neterbit NW-431F, a small-form-factor networking device; the affected resource is the JSON endpoint /sms.json. The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the endpoint returns data to a requester without performing an authorization check, leaking content that should be restricted to an authenticated administrative session. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) confirms the attack is network-delivered, requires no privileges and no user interaction, and that the security impact is limited to confidentiality at the Low level - the attacker cannot modify data or degrade availability, and there is no scope change in our assessed CVSS 3.1 vector. Because the CPE is registered as cpe:2.3:a:neterbit:nw-431f:*:*:*:*:*:*:*:* with a wildcard version, all firmware builds of the product should be treated as potentially affected until the vendor publishes a fixed release; the disclosure references build 20250715 specifically. The underlying flaw is typical of embedded management interfaces where sensitive status or SMS/messaging configuration data is served by a lightweight HTTP handler that trusts any network client, making the endpoint's accessibility - not the complexity of the exploit - the limiting factor.
Know when Nw 431F gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated access to /sms.json yields only limited information disclosure, so PR:N and C:L with I:N/A:N and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB