CVE-2024-48456

CVE-2024-48456 is an information disclosure vulnerability affecting multiple Netis router models, including the Wifi6 Router NX10 (versions 2.0.1.3643 and 2.0.1.3582), Wifi 11AC Router NC65 (3.0.0.3749), NC63 (3.0.0.3327 and 3.0.0.3503), NC21 (3.0.0.3800, 3.0.0.3500, and 3.0.0.3329), and Wifi Router MW5360 (1.0.1.3442 and 1.0.1.3031). Classified under CWE-125 (out-of-bounds read), it allows a remote attacker to extract sensitive information via the "password" parameter on the change admin password page of the router's web interface. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no prerequisites for exploitation.

Any unauthenticated remote attacker with network access to the router's web interface can exploit this by submitting crafted requests to the vulnerable admin password change endpoint. Exploitation yields sensitive data disclosure, such as administrator credentials or other configuration details, enabling potential privilege escalation, lateral movement, or full device takeover depending on the revealed information.

The sole reference is a GitHub project page (https://github.com/users/h00die-gr3y/projects/1/views/1), which documents the vulnerability but provides no vendor advisories, patches, or mitigation guidance. Practitioners should monitor Netis for firmware updates, restrict web interface exposure to trusted networks, and implement web application firewalls to block anomalous parameter manipulation in affected models.