Unauthenticated SMS Disclosure in Neterbit NW-431F

The Neterbit NW-431F embedded LTE router, specifically running firmware version 20250715, contains an unauthenticated information disclosure vulnerability identified as CVE-2026-108578. The vulnerability resides in the /sms.json web endpoint, which returns stored SMS records, including sender numbers, timestamps, and message bodies, without requiring any authentication. Because these routers utilize SIM cards to facilitate cellular communication, the exposed SMS logs often contain sensitive information such as one-time passcodes (OTP) intended for multi-factor authentication or account recovery. The vulnerability was disclosed following an unsuccessful attempt to coordinate with the vendor. As of the time of reporting, no security patch is available to resolve the underlying access control issue.

Impact

Successful exploitation allows remote, unauthenticated attackers to intercept SMS messages sent to the router's SIM card. This enables the theft of sensitive authentication tokens, such as OTPs, which may lead to account takeover or further compromise of services linked to the cellular number associated with the router. The vulnerability affects all Neterbit NW-431F devices running the specified firmware.

Recommendation

1. Restrict access to the router's management web interface; do not expose the interface to the internet.
2. Implement an access control list (ACL) or reverse proxy rule to block all HTTP requests to the /sms.json endpoint.
3. Move the device management interface to a segmented management VLAN or require a VPN connection for administrative access.
4. If the SMS functionality is not required, consider replacing the device with hardware that allows for the secure disabling of such features.
5. Audit network traffic for unauthorized GET /sms.json requests to identify exploitation attempts against managed devices.