CVE-2025-67446
A critical flaw in Neterbit NW‑431F routers allows attackers to bypass authentication by simply changing a cookie value. The vulnerability is present in firmware 20241014‑IR03 and earlier. It lets an unauthenticated user gain full administrative control of the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Neterbit NW‑431F Router firmware 20241014‑IR03 and all earlier releases.
Real-world impact
An attacker who can modify the router’s cookie can log in as an administrator without knowing any credentials. This gives them the ability to reconfigure the router, redirect traffic, install malicious firmware, or use the device as a launch point for further attacks.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited over the network (AV:N), requires no user interaction (UI:N), and needs no privileges (PR:N). Once exploited, the attacker can fully compromise confidentiality, integrity, and availability of the router’s functions, justifying the critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.