# CVE-2025-67448: Neterbit NW-431F Router stored XSS in SMS module

Source: https://junglewise.ai/threats/cve-2025-67448-neterbit-nw-431f-router-stored-xss-in-sms-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2025-67448 · Severity: high · CVSS 7.1 · Published 2026-06-04

The Neterbit NW-431F, a 4G desktop router used for home and office internet connectivity, contains a security flaw in its SMS management module. An attacker can send a specially crafted SMS message to the router that, when viewed by an administrator through the web management interface, executes malicious code in their browser. This could allow an attacker to steal login session cookies or perform unauthorized actions on the router.

Technologies: [Neterbit NW-431F Router](https://junglewise.ai/threats/technologies/nw-431f-router). Vendors: [Neterbit](https://junglewise.ai/threats/vendors/neterbit).

## Quick answers

**Is CVE-2025-67448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67448 being exploited in the wild.

**How severe is CVE-2025-67448?** High severity, with a CVSS score of 7.1, published 4 June 2026.

**Which products and versions are affected?** Neterbit NW-431F Router 20241014-IR03 and earlier.

**Is there a fix for CVE-2025-67448?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-67448 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-67448?** Check whether you run Neterbit NW-431F Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the SMS module of the Neterbit NW-431F router. The vulnerability is caused by a failure to properly sanitize user-supplied input within SMS messages before they are stored and rendered in the web-based management console. An unauthenticated remote attacker can exploit this by sending an SMS containing a malicious JavaScript payload. When an authenticated user views the SMS inbox via the router's web interface, the payload executes in the context of their browser session, potentially leading to session hijacking via cookie theft or unauthorized configuration changes. As of the advisory date, a fixed version has not been identified.

## Affected products

- Neterbit NW-431F Router 20241014-IR03 and earlier

## Timeline

- 2026-06-04: advisory: NVD publication date
- 2026-06-04: disclosed: Public disclosure of vulnerability and PoC

## References

- [https://github.com/fun-beep/CVEs/tree/main/CVE-2025-67448](https://github.com/fun-beep/CVEs/tree/main/CVE-2025-67448)
- [https://neterbit.com/](https://neterbit.com/)

## Related threats

- [Neterbit NW-431F auth bypass in at_command.asp](https://junglewise.ai/threats/cve-2025-69755-neterbit-nw-431f-auth-bypass-in-at-command-asp)
- [Neterbit NW-431F Router OS command injection in ping module](https://junglewise.ai/threats/cve-2025-67447-neterbit-nw-431f-router-os-command-injection-in-ping-module)
- [Neterbit NW-431F authentication bypass via predictable cookie](https://junglewise.ai/threats/cve-2025-67446-neterbit-nw-431f-authentication-bypass-via-predictable-cookie)