CVE-2025-2919

low-risk

Published 2025-03-28

A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Do I need to act?

0.08% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.8/10 Medium

PHYSICAL / LOW complexity

Affected Products (1)

Netis Wf-2404 Firmware

Affected Vendors

Netis-Systems

References (5)

Exploit https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-with

Permissions Required https://vuldb.com/?ctiid.301894

Third Party Advisory https://vuldb.com/?id.301894

Third Party Advisory https://vuldb.com/?submit.521036

Exploit https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-with

/ 100

low-risk

Severity 22/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal