CVE-2025-45835 Null dereference in n/a

High 7.5 Published 12 May 2025 Updated 12 May 2025

Attackers can cause a denial-of-service crash in Netis WF2880 routers by manipulating the CONTENT_LENGTH environment variable.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-45835?

CVE-2025-45835 is a high-severity vulnerability in n/a, published on 12 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the environment variable value CONTENT_LENGTH, causing the program to crash and potentially leading to a denial-of-service (DoS) attack.

Weakness: CWE-476

Which versions are affected by CVE-2025-45835?

It affects 1 product.

Products include Netis-Systems Wf2880 Firmware.

How do I fix CVE-2025-45835?

No fix has been published for CVE-2025-45835 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-45835 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-45835 exists.

Sources

Also known as GHSA-gp6q-p5qw-43q6.