CVE-2020-37093: Netis E1+ Information Disclosure Flaw

CVE-2020-37093 Overview

CVE-2020-37093 is an information disclosure vulnerability affecting Netis E1+ routers running firmware version 1.2.32533. The vulnerability allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.cgi endpoint. By sending a simple GET request to the vulnerable endpoint, attackers can extract sensitive network credentials including SSID and WiFi passwords in plain text without any authentication.

Critical Impact

Unauthenticated remote attackers can harvest WiFi credentials from vulnerable Netis E1+ routers, potentially enabling unauthorized network access and further lateral movement within targeted environments.

Affected Products

• Netis E1+ firmware version 1.2.32533

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37093 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37093

Vulnerability Analysis

This vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The core issue stems from the netcore_get.cgi endpoint exposing sensitive WiFi configuration data without requiring any form of authentication. When an attacker sends a crafted GET request to this endpoint, the router responds with the wireless network SSID and password in plain text format.

The vulnerability is network-exploitable, meaning any attacker with network access to the router's management interface can retrieve the WiFi credentials. This is particularly dangerous because many consumer routers have their management interfaces accessible from the local network by default, and in some misconfigurations, even from the internet.

Root Cause

The root cause of this vulnerability is improper access control on the netcore_get.cgi endpoint. The firmware fails to implement authentication checks before returning sensitive configuration data. This is a classic case of broken access control where sensitive administrative functions are exposed without proper authorization verification.

Attack Vector

The attack vector for CVE-2020-37093 is straightforward. An attacker on the same network as the vulnerable Netis E1+ router can send an unauthenticated HTTP GET request to the netcore_get.cgi endpoint. The router will respond with the wireless network configuration, including the SSID and WiFi password in clear text. This allows attackers to gain the WiFi password without needing any prior credentials or authentication.

The exploitation is trivial and requires minimal technical skill. Once obtained, the WiFi credentials can be used to:

• Connect unauthorized devices to the network
• Intercept network traffic from other connected devices
• Establish a persistent foothold for further attacks
• Pivot to other systems within the network

For technical details and proof-of-concept information, see the Exploit-DB #48384 entry and the VulnCheck Security Advisory.

Detection Methods for CVE-2020-37093

Indicators of Compromise

• Unusual HTTP GET requests to the netcore_get.cgi endpoint on the router
• Unauthorized devices connecting to the WiFi network using harvested credentials
• Multiple requests to the vulnerable endpoint from external or unexpected IP addresses
• Log entries showing access to CGI endpoints without corresponding authentication events

Detection Strategies

• Monitor network traffic for unauthenticated requests to /netcore_get.cgi on Netis E1+ devices
• Implement network segmentation to isolate router management interfaces from general network traffic
• Deploy intrusion detection rules to alert on attempts to access sensitive router endpoints
• Regularly audit connected devices for unauthorized WiFi connections

Monitoring Recommendations

• Enable logging on network firewalls to capture traffic destined for router management ports
• Configure SIEM alerts for patterns indicative of credential harvesting attempts against IoT devices
• Periodically scan the network for vulnerable Netis E1+ devices running affected firmware versions
• Monitor for new device connections to the wireless network that may indicate credential theft

How to Mitigate CVE-2020-37093

Immediate Actions Required

• Restrict access to the router's management interface to trusted IP addresses only
• Place the router management interface behind a firewall or VLAN that is not accessible from general user networks
• Change WiFi passwords immediately if the device may have been exposed
• Consider replacing the vulnerable device with a router that receives regular security updates

Patch Information

No official patch information is available from the vendor at this time. Users are advised to check the Netis Systems Homepage for any firmware updates that may address this vulnerability. Given the lack of vendor response, upgrading to a different router model from a vendor with active security support may be the most prudent course of action.

Workarounds

• Implement network-level access controls to block external access to the router management interface
• Use a separate, isolated network for router management that is not accessible from the main LAN
• Deploy a firewall rule to block HTTP requests to the netcore_get.cgi endpoint from untrusted sources
• Consider using an external WiFi access point with better security practices while maintaining the Netis device only as a wired router

# Example iptables rule to block access to router management interface
# Apply on an upstream firewall or gateway device
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP