Nw 431F
Monthly
Unauthenticated information disclosure affects Neterbit NW-431F devices (firmware build 20250715 and, per the wildcard CPE, presumably other unspecified versions) because the Embedded Web Server exposes the /sms.json resource without adequate access control. A remote attacker who can reach the device's web interface can retrieve information from that endpoint with no credentials and no user interaction, yielding a low-confidentiality impact only - no integrity or availability effect - consistent with an overall CVSS 4.0 base score of 6.9 (CVSS 3.1 equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vendor was notified early but did not respond, so no vendor-released patch has been identified, and no public exploit code or confirmed active exploitation was observed at time of analysis; the practical risk is driven by exposure rather than by exploitation tooling. This is a moderate, not urgent, issue.
Unauthenticated information disclosure affects Neterbit NW-431F devices (firmware build 20250715 and, per the wildcard CPE, presumably other unspecified versions) because the Embedded Web Server exposes the /sms.json resource without adequate access control. A remote attacker who can reach the device's web interface can retrieve information from that endpoint with no credentials and no user interaction, yielding a low-confidentiality impact only - no integrity or availability effect - consistent with an overall CVSS 4.0 base score of 6.9 (CVSS 3.1 equivalent AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vendor was notified early but did not respond, so no vendor-released patch has been identified, and no public exploit code or confirmed active exploitation was observed at time of analysis; the practical risk is driven by exposure rather than by exploitation tooling. This is a moderate, not urgent, issue.