CVE-2025-2919
Netis WF-2404 UART hardware allows activation of test or debug logic at runtime
- State
- Published
- Severity
- 7.0 High
- Published
- Mar 28, 2025
- Updated
- Mar 28, 2025
- Reserved
- Mar 28, 2025
Description
A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.8 Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulDB |
| 3.0 | 6.8 Medium | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulDB |
| 2.0 | 7.2 High | AV:L/AC:L/Au:N/C:C/I:C/A:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WF-2404Netis |
|
References
- VDB-301894 | Netis WF-2404 UART hardware allows activation of test or debug logic at runtimevdb-entry
- VDB-301894 | CTI Indicators (IOB, IOC)signaturepermissions-required
- Submit #521036 | Netis WF-2404 Firmware Version: APR-R4A4-V1.1.124EN-Netis(WF-2404),2010.12.14 16:18. Hardware Allows Activation of Test or Debug Logic at Runtimethird-party-advisory
- https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-withexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.