QwikSec

Security Database

CVE

CWE

Training

CVE-2025-3759

Published: May 8, 2025

Modified: May 8, 2025

PUBLISHED

Description

Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way.

Vendor	Product	Versions
Netis Systems	WF2220	affected `1.2.31706`

Weaknesses (CWE)

References

https://cert.pl/posts/2025/05/CVE-2025-3758

third-party-advisory

https://cert.pl/en/posts/2025/05/CVE-2025-3758

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.