CVE-2025-67447
published 2026-06-04CVE-2025-67447: The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.03%
59.3th percentile
The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection.
ghsa_unreviewed·2026-06-04
CVE-2025-67447 [CRITICAL] CWE-78 The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection.
The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.
VulDB
Neterbit NW-431F up to 20241014 Ping Command os command injection
vuldb·2026-06-04·CVSS 9.8
CVE-2025-67447 [CRITICAL] Neterbit NW-431F up to 20241014 Ping Command os command injection
A vulnerability categorized as critical has been discovered in Neterbit NW-431F up to 20241014. Affected by this vulnerability is an unknown functionality of the component Ping Command Handler. Such manipulation leads to os command injection.
This vulnerability is referenced as CVE-2025-67447. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-04
Published