PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-67447 Neterbit CVE debrief

The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.

Vendor
Neterbit
Product
NW-431F Router 20241014-IR03
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Administrators and users of Neterbit NW-431F Router 20241014-IR03 and before should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by improper sanitization of user input in the IP address field of the ping module. This allows an attacker to inject arbitrary OS commands, which will be executed with the privileges of the web server.

Defensive priority

high

Recommended defensive actions

  • Update to the latest firmware version if available.
  • Disable the ping module if not necessary.
  • Implement proper input validation and sanitization for the IP address field.
  • Monitor the system for suspicious activity.

Evidence notes

The CVE record was obtained from the official CVE database. The vulnerability details were extracted from the CVE description and the NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-67447 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-67447

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-67447 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-67447

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.