PT-2025-13558 · Netis · Netis Wf-2404

Scoozi · Published 2025-03-28 · Updated 2025-03-29 · CVE-2025-2920

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netis WF-2404 version 1.1.124EN

Description A vulnerability was found in the processing of the file /etc/passwd, which leads to the use of a weak hash. The complexity of an attack is rather high, and the exploitation is known to be difficult. However, the exploit has been disclosed to the public and may be used. The attack can be launched on the physical device.

Recommendations For Netis WF-2404 version 1.1.124EN, as a temporary workaround, consider restricting access to the /etc/passwd file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2025-2920

Affected Products

Netis Wf-2404

References · 9

• 🔥 https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-cont · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2920 · Security Note
• https://twitter.com/VulmonFeeds/status/1905748794404429949 · Twitter Post
• https://t.me/cvetracker/20211 · Telegram Post
• https://vuldb.com/?id.301895 · Note
• https://vuldb.com/?submit.521037 · Note
• https://twitter.com/CVEnew/status/1905787782062080510 · Twitter Post
• https://vuldb.com/?ctiid.301895 · Note
• https://t.me/cvedetector/21457 · Telegram Post