CVE-2024-48456 in the critical feed json
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.…
published 2025-01-06 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-43218
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 16.9%
- EPSS 16.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the parameter password at the change admin password page at the router web interface.
Timeline
- First public exploit (Metasploit exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 22 mo ago
Exploit prediction
16.95% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/netis_unauth_rce_cve_2024_48456_and_48457 Netis Router Exploit Chain Reactor (CVE-2024-48455, CVE-2024-48456 and CVE-2024-48457). metasploit exploit, excellent rank, 2024-12-27
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
Sources
- CVE List CVE-2024-48456
- NVD CVE-2024-48456
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.