PT-2025-20697 · Netis · Netis Wf2880

Chinesexilinyu · Published 2025-05-12 · Updated 2025-07-09 · CVE-2025-45835

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netis WF2880 version 2.1.40207

Description A null pointer dereference issue was discovered. The issue exists in the FUN 004904c8 function of the cgitest.cgi file. Attackers can trigger this issue by controlling the environment variable value CONTENT LENGTH, causing the program to crash and potentially leading to a denial-of-service (DoS) attack.

Recommendations For Netis WF2880 version 2.1.40207, as a temporary workaround, consider restricting access to the cgitest.cgi file or disabling the FUN 004904c8 function until a patch is available. Avoid using the CONTENT LENGTH environment variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-45835

Affected Products

Netis Wf2880

References · 9

• 🔥 https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Null-Pointer-Dereference-Vulnerability/tree/main/1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-45835 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45835 · Security Note
• https://twitter.com/CVEnew/status/1921924538633158985 · Twitter Post
• https://t.me/cvedetector/25090 · Telegram Post
• https://twitter.com/cracbot/status/1923695093891932661 · Twitter Post
• https://t.me/cvenotify/128130 · Telegram Post
• https://t.me/cvetracker/23615 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1921937422385910263 · Twitter Post