CVE-2024-48455
published 2025-01-06CVE-2024-48455: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and…
PriorityP267low2.7CVSS 3.1
AVNACLPRHUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.25%
92.7th percentile
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /cgi-bin/skk_get.cgi HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
mode_name=skk_get&wl_link=0↗
- →Detect exploitation attempts by monitoring POST requests to /cgi-bin/skk_get.cgi with body parameters mode_name=skk_get and wl_link=0; no authentication is required by the attacker. ↗
- →Successful exploitation responses will contain all four JSON keys: 'version":', 'vender":', 'statsList":', and 'uptime":' in the response body with HTTP 200 status. ↗
- →CVE-2024-48455 is used as a reconnaissance step in an exploit chain to fingerprint vulnerable firmware versions before chaining with CVE-2024-48456 (RCE) and CVE-2024-48457 (unauthenticated password reset). ↗
- →Use FOFA query 'title="Netis"' to identify internet-exposed Netis router admin panels potentially vulnerable to this CVE. ↗
- ·The vulnerability affects multiple Netis router models and firmware versions across NX10, NC65, NC63, NC21, and MW5360 product lines, as well as rebranded GLCtec and Stonet routers running the same firmware. ↗
- ·The endpoint /cgi-bin/skk_get.cgi requires no authentication, making this information disclosure exploitable by any remote attacker without credentials. ↗
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
vulncheck2.7LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jhc7-3m5f-4pm9: An issue in Netis Wifi6 Router NX10 2
ghsa_unreviewed·2025-01-07
CVE-2024-48455 [LOW] GHSA-jhc7-3m5f-4pm9: An issue in Netis Wifi6 Router NX10 2
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.
VulnCheck
Netis Router skk_get.cgi Information Disclosure Vulnerability
vulncheck·2024·CVSS 2.7
CVE-2024-48455 [LOW] Netis Router skk_get.cgi Information Disclosure Vulnerability
Netis Router skk_get.cgi Information Disclosure Vulnerability
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.
Affected: Netis Netis Router
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-04&host_type=src&vulnerab
No detection rules found.
Nuclei
Netis Wifi Router - Information Disclosure
nuclei·CVSS 2.7
CVE-2024-48455 [LOW] Netis Wifi Router - Information Disclosure
Netis Wifi Router - Information Disclosure
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.
Template:
id: CVE-2024-48455
info:
name: Netis Wifi Router - Information Disclosure
author: s4e-io
severity: high
description: |
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.
Metasploit
Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457).
metasploit·CVSS 2.7
CVE-2024-48455 [LOW] Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457).
Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457).
Several Netis Routers including rebranded routers from GLCtec and Stonet suffer from a command injection vulnerability at the change admin password page of the router web interface (see CVE-2024-48456 for more details). The vulnerability stems from improper handling of the 'password' and 'new password' parameter within the router's web interface. Attackers can inject a command in the 'password' or 'new password' parameter, encoded in base64, to exploit the command injection vulnerability. When exploited, this can lead to command execution, potentially allowing the attacker to take full control of the router. An attacker needs to be authenticated to initiate this RCE, however CVE-2024-48457 allows an un
2025-01-06
Published
Exploited in the wild