CVE-2025-3759 HIGH

CVE-2025-3759: Missing Authentication for Changing Device Configuration in WF2220

Vendor Netis Systems
Product WF2220
Weakness CWE-306 · Missing auth
Published May 8, 2025
Last update May 8, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

May 8, 2025 CVE published
May 8, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-26394 Unauthenticated network reconfiguration via TCP/UDP CVE-2022-1368 Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs CVE-2024-5952 Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability CVE-2025-41654 PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol