PT-2025-20372 · Netis Systems · Wf2220

Kamil Szczurowski · Published 2025-05-08 · Updated 2025-05-08 · CVE-2025-3759

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description The endpoint /cgi-bin-igd/netcore set.cgi is used for changing device configuration and is accessible without authentication, posing a significant security threat. This could allow for administrator account hijacking or AP password changing. The vendor was contacted about this disclosure but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-3759

Affected Products

Wf2220

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3759 · Security Note
• https://t.me/cvenotify/121328 · Telegram Post
• https://t.me/latest_high_impact_cve/2302 · Telegram Post
• https://twitter.com/CVEnew/status/1920437023586070932 · Twitter Post
• https://t.me/cvetracker/23347 · Telegram Post
• https://cert.pl/posts/2025/05/CVE-2025-3758 · Note
• https://cert.pl/en/posts/2025/05/CVE-2025-3758 · Note
• https://t.me/cvedetector/24813 · Telegram Post