An attacker can send a specially crafted command to the at_command.asp interface on the Neterbit NW-431F Router, allowing them to retrieve sensitive information and run arbitrary code on the device. The vulnerability stems from insufficient input validation on the at_command.asp endpoint, creating a remote code execution condition. This flaw can compromise confidentiality, integrity, and availability of the router and any connected network traffic.

The affected product is the Neterbit NW-431F Router, specifically firmware version vNW-431F-20241014-IR03. No other versions or variants were listed in the CNA data.

The CVSS score of 8.2 indicates a high severity, but the EPSS score is not available, making it unclear how frequently the weakness is exploited in the wild. The vulnerability is not currently in the CISA KEV catalog. Based on the description, the likely attack vector is remote over an Internet-facing interface through HTTP requests directed at the at_command.asp endpoint. An attacker would need to craft a payload that bypasses the router’s authentication or rely on default credentials to exploit the flaw.