CVE-2025-67446

June 4, 2026, 7:15 p.m.

9.8
Critical

Description

Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass the authentication schema and gain unauthorized access to admin functionalities.

Product(s) Impacted

Vendor Product Versions
Neterbit
  • Nw-431f Router
  • 20241014-IR03

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-384
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
h neterbit nw-431f_router 20241014-IR03 / / / / / / /

References

https://github.com/fun-beep/CVEs/tree/main/CVE-2025-67446
https://neterbit.com/
https://github.com/fun-beep/CVEs/tree/main/CVE-2025-67446

Tags

[email protected]
CWE-384
2026-06-04
CVE-2025-67446

CVSS Score

9.8 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: June 4, 2026, 5:16 p.m.
Last Modified: June 4, 2026, 7:15 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.