CVE-2025-3758: Netis Systems WF2220

High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days.

WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• Netis Systems WF2220: version 1.2.31706 only

Published 2025-05-08. Last modified 2026-06-17.