CVE-2024-48457

HIGH

Netis Wifi6 Router Multiple Versions - Out-of-bounds Read via /cgi-bin/skk_set.cgi

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-48457. Includes Metasploit module exploits/linux/http/netis_unauth_rce_cve_2024_48456_and_48457.

AI-analyzed exploit summary This Metasploit module exploits an exploit chain in Netis routers, combining unauthenticated password reset (CVE-2024-48457) and authenticated command injection (CVE-2024-48456) to achieve remote code execution. It also includes an information disclosure check (CVE-2024-48455).

Description

An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the endpoint /cgi-bin/skk_set.cgi and binary /bin/scripts/start_wifi.sh

Exploits (1)

metasploit WORKING POC EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/netis_unauth_rce_cve_2024_48456_and_48457.rb

This Metasploit module exploits an exploit chain in Netis routers, combining unauthenticated password reset (CVE-2024-48457) and authenticated command injection (CVE-2024-48456) to achieve remote code execution. It also includes an information disclosure check (CVE-2024-48455).

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Netis Routers (multiple models and firmware versions)
No auth needed
Prerequisites: Network access to the router's web interface
devstral-2 · analyzed Apr 23, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.6705
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-125
Status published
Published Jan 06, 2025
Tracked Since Feb 18, 2026