netis-systems Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with netis-systems products.

Products

Showing 22 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Netcore / Netis Routers RCE via UDP Port 53413 Backdoor

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device …

CWE-306CWE-78CWE-912Jul 16, 2025
CVSS9.3v4.0EPSS19.9%PoCs2SignalsSTIX

netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page.

CWE-78May 3, 2024
CVSS5.3v3.1EPSS0.313%PoCs0SignalsSTIX

netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page.

CWE-20CWE-78May 3, 2024
CVSS9.8v3.1EPSS0.965%PoCs0SignalsSTIX

A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the getTimeZone function.

CWE-79May 3, 2024
CVSS4.6v3.1EPSS0.385%PoCs0SignalsSTIX

Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi.

CWE-78Feb 22, 2024
CVSS8.0v3.1EPSS1.94%PoCs0SignalsSTIX

Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter

CWE-77Feb 22, 2024
CVSS9.8v3.1EPSS19.1%PoCs0SignalsSTIX

netis-systems mw5360_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')

NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.

CWE-77Jan 25, 20241 related artifact
CVSS9.8v3.1EPSS70.8%PoCs1SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CWE-120Oct 13, 2023
CVSS7.5v3.1EPSS0.687%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CWE-120Oct 13, 2023
CVSS7.5v3.1EPSS0.623%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.

CWE-78Oct 13, 2023
CVSS9.8v3.1EPSS1.9%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.

CWE-77Oct 13, 2023
CVSS9.8v3.1EPSS1.9%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CWE-120Oct 13, 2023
CVSS7.5v3.1EPSS0.623%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.

CWE-77Oct 13, 2023
CVSS9.8v3.1EPSS1.84%PoCs0SignalsSTIX

An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.

CWE-863Oct 6, 2023
CVSS7.5v3.1EPSS19.5%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted HTTP request.

CWE-78Oct 2, 2023
CVSS8.8v3.1EPSS2.52%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.

CWE-77Oct 2, 2023
CVSS9.8v3.1EPSS1.89%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.

CWE-78Oct 2, 2023
CVSS9.8v3.1EPSS1.89%PoCs0SignalsSTIX

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.

CWE-78Oct 2, 2023
CVSS9.8v3.1EPSS1.89%PoCs0SignalsSTIX

There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.

CWE-862Sep 20, 2023
CVSS9.8v3.1EPSS0.758%PoCs0SignalsSTIX

An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component.

CWE-798Sep 16, 2023
CVSS9.8v3.1EPSS1.08%PoCs0SignalsSTIX

An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.

CWE-77Sep 11, 2023
CVSS8.8v3.1EPSS2.01%PoCs1SignalsSTIX

netis-systems dl4343_firmware Improper Privilege Management

On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page.

CWE-269Dec 29, 2019
CVSS8.8v3.1EPSS1.43%PoCs0SignalsSTIX