Summary of CVE-2025 Vulnerabilities in Netis Systems WF2220
On May 8, 2025, CERT Polska announced vulnerabilities in the Netis Systems WF2220 product, specifically affecting version 1.2.31706. The vulnerabilities, identified as CVE-2025-3758 and CVE-2025-3759, are significant security concerns tied to a critical lack of authentication.
Vulnerability Details
CVE-2025-3758:
This vulnerability exposes the endpoint /cgi-bin-igd/netcore_get.cgi, which allows unauthorized users to access the device’s configuration. This unauthorized access includes sensitive information, like passwords presented in clear text, which can lead to exploitation.
CVE-2025-3759:
Similarly, this vulnerability involves the endpoint /cgi-bin-igd/netcore_set.cgi, which is accessible without any authentication. The lack of security here enables malicious actors to modify the device’s configuration. For instance, this could lead to the hijacking of administrator accounts or alter the access point’s (AP) password, further compounding security risks.
Both vulnerabilities fall under the Common Weakness Enumeration (CWE) category of "Lack of Authentication for Critical Function" (CWE-306).
Reporting and Disclosure Process
The report of these vulnerabilities was submitted to CERT Polska, which facilitated the coordination for their disclosure. Despite CERT Polska’s attempts to contact Netis Systems for a response or potential patch, no communication has been received from the vendor. Following their policy, CERT Polska proceeded to publish the vulnerability details 90 days after the initial outreach attempt.
The organization acknowledged Kamil Szczurowski for responsibly reporting the vulnerabilities, underscoring the importance of collaboration within the security community for timely and effective vulnerability management.
Conclusion
The vulnerabilities in the Netis Systems WF2220 present considerable risks due to unauthorized access to critical functionalities. Users of this product are advised to remain vigilant regarding these vulnerabilities and consider reviewing their device security measures. Organizations are also encouraged to stay updated on such vulnerabilities to ensure their systems are protected against potential exploitation.
For more information about vulnerability disclosure coordination, interested parties can visit CERT Polska’s website at cert.pl.