CVE-2025-3758 HIGH

CVE-2025-3758: Exposure of Device Configuration without Authentication in WF2220

Vendor Netis Systems
Product WF2220
Weakness CWE-306 · Missing auth
Published May 8, 2025
Last update October 3, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

May 8, 2025 CVE published
October 3, 2025 Record updated