High severity · published May 8, 2025
CVE-2025-3758
Exposure of Device Configuration without Authentication in WF2220
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password.
The vendor was contacted early about this disclosure but did not respond in any way.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
WF2220 · Netis Systems
1.2.31706 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3758
cert.pl
https://cert.pl/en/posts/2025/05/CVE-2025-3758
cert.pl
https://cert.pl/posts/2025/05/CVE-2025-3758
More from WF2220
8.7
CVE-2025-3759
Missing Authentication for Changing Device Configuration in WF2220