CVE-2026-108578

Executive Summary

CVE-2026-108578 is an unauthenticated information disclosure vulnerability affecting the Neterbit NW-431F embedded web server, firmware build 20250715. A remote attacker can retrieve sensitive data by manipulating the /sms.json endpoint, resulting in unauthorized access to information handled by this component. No public proof-of-concept, exploit code, or vendor patch currently exists, and the vendor did not respond to early disclosure communication.

Technical Analysis

The vulnerability resides in the Embedded Web Server component of the Neterbit NW-431F. Per the NVD description, the impacted element is an unknown function associated with the file /sms.json. The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the attack is network-reachable, requires no privileges or user interaction, and yields a limited confidentiality impact with no integrity or availability impact.

The exact code path that permits the disclosure is not documented in the provided intelligence. What is known is that the /sms.json resource — evidently an API-style JSON endpoint associated with the device's SMS functionality — returns data without adequate access control or authorization enforcement. Information disclosure vulnerabilities of this class occur when an endpoint fails to validate that the requester is authenticated and authorized to view the underlying data, or when it exposes more data than the calling context requires (excessive data exposure).

Because the underlying implementation (the specific function, parameter handling, or data filtering logic) is not described, no code-level details can be asserted. The attack surface is the device's web management interface, exposed over the network, and reachable without credentials. The limited C:L rating indicates that the disclosed data is confidential but not of the highest severity — consistent with device telemetry, configuration metadata, or SMS-related records rather than administrative credentials.

The NW-431F is an embedded cellular/SMS gateway type device. Devices in this class typically expose JSON endpoints for status, configuration, and messaging. An open /sms.json endpoint could expose SMS message contents, sender/recipient numbers, message metadata, or device-side configuration values. The precise data set exposed in this instance is not stated in the CVE record and should be confirmed through direct device testing.

Exploitation Scenarios

No public PoC or exploit exists; the attack chain below is inferred from the vulnerability class (CWE-200) and the CVSS vector, and is limited to what the NVD description supports.

1. Reconnaissance / target identification. An adversary scans internet- or LAN-exposed Neterbit NW-431F management interfaces. Fingerprinting can be performed by requesting the known file path /sms.json and observing the response (HTTP status, content type, and body structure). Shodan-type searches for the device web UI or the /sms.json string can enumerate candidate targets.

2. Triggering the flaw. The attacker sends an HTTP request to the /sms.json resource on the embedded web server without valid authentication. Because the vector specifies PR:N and UI:N, no credentials and no user interaction are required. The request targets the documented file path directly.

3. Payload/execution. At the vulnerability-class level, exploitation consists of a single unauthenticated GET-style request to /sms.json. There is no evidence in the provided data of command injection, memory corruption, or code execution; the flaw is a data exposure issue. Therefore no crafted payload beyond an ordinary HTTP request to that endpoint is required.

4. Post-exploitation impact. The response discloses information to which the requester should not have access. Depending on what the endpoint returns, an attacker could harvest sensitive device or messaging data to support further targeting, social engineering, or lateral movement planning. Given the C:L rating, the immediate impact is limited to confidentiality of the exposed data set; integrity and availability are unaffected.

No exploitation in the wild has been reported, CISA KEV does not list this CVE, and no threat-actor campaign is associated with it in the available data.

Impact Assessment

The primary impact is unauthorized disclosure of information from the NW-431F embedded web server. With CVSS 5.3 (Medium), the vector assigns Confidentiality:Low, Integrity:None, Availability:None. The blast radius is limited to the confidentiality of data served by the affected endpoint; the device itself remains operational and its configuration is not altered by the attack.

Affected systems are Neterbit NW-431F devices running firmware build 20250715 that expose the embedded web server and the /sms.json resource. Because no affected-version range is published (only the specific build date), any deployment of this model at or around that firmware revision should be treated as potentially affected until verified. Business impact is highest where these devices sit at network edges and store SMS or telemetry data that is operationally or personally sensitive. Lateral movement risk depends on the content exposed; if the endpoint leaks credentials, tokens, or network configuration, the practical impact could exceed the CVSS subscore.

The absence of a patch, workaround, and vendor response elevates residual risk: defenders cannot remediate through vendor-supplied updates and must rely on compensating network controls.

Detection Guidance

Sigma Rule

title: Neterbit NW-431F Unauthenticated Access to sms.json
id: 7c2f9a10-4b8e-4d21-9a6f-1b2c3d4e5f60
status: experimental
description: Detects HTTP requests to the /sms.json endpoint of Neterbit NW-431F embedded web server, indicative of CVE-2026-108578 information disclosure attempts.
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/sms.json'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_uri and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - sc-status
falsepositives:
  - Legitimate administrative dashboard polling the endpoint
level: medium
tags:
  - attack.t1190
  - cve.2026.108578
  - cwe.200

YARA Rule

rule CVE_2026_108578_Neterbit_sms_json
{
    meta:
        description = "Detects references to the Neterbit NW-431F sms.json endpoint associated with CVE-2026-108578 information disclosure"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-108578"
        cve = "CVE-2026-108578"

    strings:
        $uri = "/sms.json" ascii wide nocase
        $model = "NW-431F" ascii wide nocase
        $web = "Embedded Web Server" ascii wide nocase

    condition:
        $uri and any of ($model, $web)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108578 Neterbit NW-431F Unauthenticated sms.json Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/sms.json"; http.uri; endswith; reference:cve,2026-108578; classtype:attempted-recon; sid:2026108578; rev:1;)

Elastic Detection

sequence by source.ip
  [network where http.request.method in ("GET", "POST") and endsWith(http.request.uri.path, "/sms.json")]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=fortinet_utm
| search uri_path="*/sms.json" OR cs_uri_stem="*/sms.json"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri_path, http_method
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="neterbit,cve-2026-108578,web,">
  <rule id="1085780" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/sms.json</url>
    <description>CVE-2026-108578: Neterbit NW-431F unauthenticated access to /sms.json (information disclosure)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108578,information_disclosure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the NW-431F embedded web server. Place management interfaces behind a firewall or VPN and block inbound access from untrusted networks to the HTTP/HTTPS management ports. If the /sms.json endpoint is not required, restrict or block requests to that path at the reverse proxy or WAF layer. Disable the embedded web server entirely where remote management is not operationally necessary. Monitor access logs for unauthenticated requests to /sms.json.

2. Patch/upgrade steps. No vendor patch is available; the vendor was contacted but did not respond. Monitor the Neterbit vendor site and the NVD entry for CVE-2026-108578 for a firmware update addressing build 20250715. Where the device is no longer supported or the vendor remains non-responsive, plan for replacement with a supported product.

3. Long-term hardening. Enforce authentication and authorization on all JSON/API endpoints. Segment embedded/IoT management planes onto isolated VLANs. Apply least-privilege network policy to device management. Conduct periodic firmware review and maintain an inventory of edge devices with known unpatched vulnerabilities; escalate devices past end-of-support to replacement.

References

• NVD — CVE-2026-108578: https://nvd.nist.gov/vuln/detail/CVE-2026-108578
• CWE-200, Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verify current listing status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Vendor: Neterbit — no advisory published; vendor did not respond to disclosure communication.