CVE-2025-3759
Missing Authentication for Changing Device Configuration in WF2220
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Missing Authentication for Changing Device Configuration in WF2220
Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way.
Reserved 2025-04-17 | Published 2025-05-08 | Updated 2025-05-08 | Assigner CERT-PLCWE-306 Missing Authentication for Critical Function
Kamil Szczurowski
cert.pl/posts/2025/05/CVE-2025-3758
cert.pl/en/posts/2025/05/CVE-2025-3758
Support options
