{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nw-431f-firmware-20250715/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:neterbit:nw-431f:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-108578"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NW-431F (firmware 20250715)"],"_cs_severities":["medium"],"_cs_tags":["information-disclosure","router","lte","cve-2026-108578"],"_cs_type":"advisory","_cs_vendors":["Neterbit"],"content_html":"\u003cp\u003eThe Neterbit NW-431F embedded LTE router, specifically running firmware version 20250715, contains an unauthenticated information disclosure vulnerability identified as CVE-2026-108578. The vulnerability resides in the \u003ccode\u003e/sms.json\u003c/code\u003e web endpoint, which returns stored SMS records, including sender numbers, timestamps, and message bodies, without requiring any authentication. Because these routers utilize SIM cards to facilitate cellular communication, the exposed SMS logs often contain sensitive information such as one-time passcodes (OTP) intended for multi-factor authentication or account recovery. The vulnerability was disclosed following an unsuccessful attempt to coordinate with the vendor. As of the time of reporting, no security patch is available to resolve the underlying access control issue.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to intercept SMS messages sent to the router's SIM card. This enables the theft of sensitive authentication tokens, such as OTPs, which may lead to account takeover or further compromise of services linked to the cellular number associated with the router. The vulnerability affects all Neterbit NW-431F devices running the specified firmware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eRestrict access to the router's management web interface; do not expose the interface to the internet.\u003c/li\u003e\n\u003cli\u003eImplement an access control list (ACL) or reverse proxy rule to block all HTTP requests to the \u003ccode\u003e/sms.json\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eMove the device management interface to a segmented management VLAN or require a VPN connection for administrative access.\u003c/li\u003e\n\u003cli\u003eIf the SMS functionality is not required, consider replacing the device with hardware that allows for the secure disabling of such features.\u003c/li\u003e\n\u003cli\u003eAudit network traffic for unauthorized \u003ccode\u003eGET /sms.json\u003c/code\u003e requests to identify exploitation attempts against managed devices.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-15T18:03:18Z","date_published":"2026-10-15T18:03:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-neterbit-sms-disclosure/","summary":"Neterbit NW-431F LTE routers are vulnerable to unauthenticated information disclosure via the /sms.json endpoint, allowing attackers to retrieve SMS messages including potential one-time passcodes.","title":"Unauthenticated SMS Disclosure in Neterbit NW-431F","url":"https://feed.craftedsignal.io/briefs/2026-10-neterbit-sms-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - NW-431F (Firmware 20250715)","version":"https://jsonfeed.org/version/1.1"}