Vulnerability · Published May 8, 2025 · Assigned by CERT-PL
CVE-2025-3759Missing Authentication for Changing Device Configuration in WF2220
High 8.7
In plain English
A high-severity missing authentication in WF2220 from Netis Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Netis Systems | WF2220 | 1.2.31706 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://cert.pl/posts/2025/05/CVE-2025-3758 third-party-advisory
- https://cert.pl/en/posts/2025/05/CVE-2025-3758 third-party-advisory