Netis-Systems
53 CVEs across 28 Netis-Systems products. Browse Netis-Systems vulnerabilities, severities, and proof-of-concept exploits.
Netis-Systems products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50617 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50616 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50615 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50614 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file. Attackers can trigger… |
CVE-2025-50613 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50612 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file. Attackers can trigger… |
CVE-2025-50611 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50610 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50609 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file. Attackers can trigger this vul… |
CVE-2025-50608 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50635 | High | 7.5 | 2025-08-13 | A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. The vulnerability exists in the FUN_0048a728 function of the cgitest.cgi fi… |
CVE-2025-45835 | High | 7.5 | 2025-05-12 | A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi fi… |
CVE-2025-3759 | | 2025-05-08 | Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security t… | |
CVE-2025-3758 | | 2025-05-08 | WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext… | |
CVE-2025-2921 | Medium | 6.4 | 2025-03-28 | A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation wit… |
CVE-2025-2919 | Medium | 6.8 | 2025-03-28 | A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The mani… |
CVE-2024-33793 | Medium | 5.3 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page. |
CVE-2024-33792 | Critical | 9.8 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page. |
CVE-2024-33791 | Medium | 4.6 | 2024-05-03 | A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-25851 | High | 8.0 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi. |
CVE-2024-25850 | Critical | 9.8 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter |
CVE-2024-22729 | Critical | 9.8 | 2024-01-25 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. |
CVE-2023-45468 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) v… |
CVE-2023-45467 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. |
CVE-2023-45466 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings. |
CVE-2023-45465 | Critical | 9.8 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings. |
CVE-2023-45464 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2023-45463 | High | 7.5 | 2023-10-13 | Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers… |
CVE-2023-44860 | High | 7.5 | 2023-10-06 | An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request. |
CVE-2023-43893 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnera… |
CVE-2023-43892 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is ex… |
CVE-2023-43891 | Critical | 9.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploi… |
CVE-2023-43890 | High | 8.8 | 2023-10-02 | Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This vulnerability is exploited via a crafted… |
CVE-2023-43134 | Critical | 9.8 | 2023-09-20 | There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authe… |
CVE-2023-42336 | Critical | 9.8 | 2023-09-16 | An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter… |
CVE-2023-38829 | High | 8.8 | 2023-09-11 | An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools… |
CVE-2023-0114 | Low | 3.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.fil… |
CVE-2023-0113 | Medium | 5.3 | 2023-01-07 | A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2018-25069 | High | 7.3 | 2023-01-07 | A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded passwo… |
CVE-2021-26747 | Critical | 9.8 | 2021-02-18 | Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. |
CVE-2020-8946 | High | 8.8 | 2020-02-12 | Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi… |
CVE-2019-19356 | High | 7.5 | 2020-02-07 | Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in fir… |
CVE-2019-20076 | Medium | 6.1 | 2019-12-30 | On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration). |
CVE-2019-20075 | Medium | 6.1 | 2019-12-30 | On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic). |
CVE-2019-20074 | High | 8.8 | 2019-12-30 | On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cgi page. |
CVE-2019-20073 | Medium | 6.1 | 2019-12-30 | On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration). |
CVE-2019-20072 | Medium | 6.1 | 2019-12-30 | On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration). |
CVE-2019-20071 | Medium | 6.5 | 2019-12-30 | On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs. |
CVE-2019-20070 | Medium | 6.1 | 2019-12-30 | On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration). |
CVE-2019-8985 | Critical | 9.8 | 2019-02-21 | On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not r… |
CVE-2018-6391 | High | 8.8 | 2018-01-29 | A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete Address Reservation… |
CVE-2018-5967 | Medium | 5.4 | 2018-01-25 | Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page. |
CVE-2018-6190 | Medium | 5.4 | 2018-01-24 | Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page. |