The Neterbit NW-431F Router firmware preceding 20241014-IR03 stores SMS content without sanitizing it, allowing an attacker to embed a malicious JavaScript payload. When a user opens the message in their browser, the payload executes in the context of the device’s web interface, potentially granting arbitrary code execution or sensitive data exfiltration. This stored cross‑site scripting flaw can compromise confidentiality, integrity and availability of the device if exploited.

Firmware versions up to and including 20241014-IR03 of the Neterbit NW-431F router are affected.

The CVSS score of 7.1 indicates a high overall severity. The EPSS score is not available, so the precise exploitation likelihood is unknown, but the flaw remains publicly documented and not listed in CISA’s KEV catalog. An attacker would need to deliver an SMS containing the payload to the target device and convince the victim to view the message in a browser; this relatively low barrier of exploitation coupled with the high impact increases the threat level. The vulnerability is easily exploitable if one can communicate with the router’s SMS module, exposing users to credential theft, session hijacking, or further network compromise.