Vulnerability · Published May 8, 2025 · Assigned by CERT-PL
CVE-2025-3758Exposure of Device Configuration without Authentication in WF2220
High 8.7
In plain English
A high-severity missing authentication in WF2220 from Netis Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netis Systems | WF2220 | 1.2.31706 |
Weakness: CWE-306, CWE-256 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://cert.pl/posts/2025/05/CVE-2025-3758 third-party-advisory
- https://cert.pl/en/posts/2025/05/CVE-2025-3758 third-party-advisory