WF2220 vulnerabilities

2 known vulnerabilities in WF2220 from Netis-systems. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  WF2220: Missing Authentication for Critical Functionality

  CVE-2025-3759May 8, 2025Netis-systems

  Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was conta

• 8.7 High severity

  WF2220: Plaintext Storage of a Password

  CVE-2025-3758May 8, 2025Netis-systems

  WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way.