CVE-2025-67446
published 2026-06-04CVE-2025-67446: Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.45%
36.2th percentile
Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass the authentication schema and gain unauthorized access to admin functionalities.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before.
ghsa_unreviewed·2026-06-04
CVE-2025-67446 [CRITICAL] CWE-384 Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before.
Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass the authentication schema and gain unauthorized access to admin functionalities.
VulDB
Neterbit NW-431F up to 20241014 Setting improper authentication
vuldb·2026-06-04·CVSS 9.8
CVE-2025-67446 [CRITICAL] Neterbit NW-431F up to 20241014 Setting improper authentication
A vulnerability has been found in Neterbit NW-431F up to 20241014 and classified as critical. The affected element is an unknown function of the component Setting Handler. Performing a manipulation results in improper authentication.
This vulnerability is known as CVE-2025-67446. Remote exploitation of the attack is possible. No exploit is available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-04
Published