VulnerabilityDeferred

CVE-2025-3758

WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users.

HIGH 8.7EPSS 0.22%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.22% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-256, CWE-306
Source: cvd@cert.pl

References

https://cert.pl/en/posts/2025/05/CVE-2025-3758
https://cert.pl/posts/2025/05/CVE-2025-3758

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.