Weak Hash Vulnerability in Netis WF-2404 Router

CVE-2025-2920

Summary

A weak hash vulnerability has been identified in the Netis WF-2404 router firmware version 1.1.124EN. This issue arises from improper processing of the '/etc/passwd' file, potentially allowing unauthorized attackers to exploit weak password hashing mechanisms. While the complexity of a successful attack remains high, the potential for exploitation exists, particularly as detailed exploits have been publicly disclosed. It's crucial for users of the Netis WF-2404 to ensure their firmware is updated and to implement additional security measures to mitigate this risk. The vendor has been alerted regarding the issue, yet no response has been received to address the vulnerability.

References