CVE-2025-3758: WF2220 Information Disclosure Vulnerability

CVE-2025-3758 Overview

CVE-2025-3758 is an information disclosure vulnerability affecting the Netcore WF2220 wireless router. The device exposes the /cgi-bin-igd/netcore_get.cgi endpoint without authentication. Any user on the adjacent network can query this endpoint and retrieve the full device configuration. The returned data includes cleartext credentials, classified under [CWE-256] (Plaintext Storage of a Password).

CERT Poland coordinated disclosure with the vendor, but the vendor did not respond. No patch is currently available for affected devices.

Critical Impact
Unauthenticated attackers within wireless or LAN range can extract device configuration containing cleartext passwords, enabling full administrative takeover of the router.

Affected Products

Netcore WF2220 wireless router (all firmware versions, no patched version disclosed)
Devices exposing the /cgi-bin-igd/netcore_get.cgi endpoint
Networks where WF2220 routers are reachable from adjacent network segments

Discovery Timeline

2025-05-08 - CVE CVE-2025-3758 published to NVD by CERT Poland
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3758

Vulnerability Analysis

The WF2220 router exposes an Internet Gateway Device (IGD) CGI endpoint at /cgi-bin-igd/netcore_get.cgi. The endpoint serves configuration data without enforcing authentication or session validation. Any client able to reach the router's HTTP interface can issue a request and receive the complete device configuration in the response.

The response payload contains administrative credentials stored and transmitted in cleartext. This combines two distinct weaknesses: missing access control on a sensitive endpoint and plaintext storage of secrets ([CWE-256]). An attacker who recovers the credentials can authenticate to the router's management interface and modify routing, DNS, firewall, or firmware settings.

The attack vector is classified as adjacent network, meaning the attacker must be on the same Wi-Fi network, LAN segment, or otherwise have layer-2 reachability. No user interaction or privileges are required.

Root Cause

The root cause is an authorization flaw in the IGD CGI handler combined with insecure credential storage. The handler returns the configuration blob regardless of the requester's identity. Credentials inside that blob are not hashed, encrypted, or redacted before transmission.

Attack Vector

An attacker joins or gains access to the adjacent network. The attacker then issues an HTTP GET request to /cgi-bin-igd/netcore_get.cgi on the router's IP. The router responds with the configuration file, which the attacker parses to extract the administrator password. The attacker authenticates to the management interface and gains full control of the device.

No verified public exploit code is available. Refer to the CERT Poland CVE-2025-3758 Analysis for the original technical writeup.

Detection Methods for CVE-2025-3758

Indicators of Compromise

HTTP GET requests to /cgi-bin-igd/netcore_get.cgi originating from unexpected internal hosts
Outbound configuration responses from the router larger than normal management traffic baselines
Administrative logins to the WF2220 from MAC addresses or IPs not associated with known administrators
Unauthorized changes to DNS, DHCP, or firewall settings on the affected router

Detection Strategies

Inspect HTTP traffic on the LAN for requests targeting the netcore_get.cgi path and alert on any source outside an approved management subnet
Correlate router configuration changes with prior access to the vulnerable endpoint using flow logs
Use network sensors to flag plaintext HTTP responses containing keywords such as password, passwd, or admin from router IP addresses

Monitoring Recommendations

Enable verbose logging on network IDS for the WF2220 management VLAN
Forward router syslog and HTTP proxy logs into a centralized analytics platform for retention and search
Establish a baseline of authorized management clients and alert on deviations

How to Mitigate CVE-2025-3758

Immediate Actions Required

Restrict access to the router's HTTP management interface to a dedicated administrative VLAN or trusted host
Block external and guest network access to /cgi-bin-igd/netcore_get.cgi at an upstream firewall where possible
Rotate the administrator password and any credentials reused from the device configuration
Replace the WF2220 with a supported router if the deployment handles sensitive traffic, since the vendor has not responded to disclosure

Patch Information

No vendor patch is available. CERT Poland reported that the vendor was contacted but did not respond. Track the CERT Poland CVE-2025-3758 Post for any future updates.

Workarounds

Segment the WF2220 onto an isolated network so that adjacent-network attackers cannot reach the CGI endpoint
Disable wireless access or enforce strong WPA2/WPA3 authentication to reduce the population of adjacent attackers
Place an upstream device that filters HTTP requests to the /cgi-bin-igd/ path from untrusted clients
Decommission and replace the device with a vendor-supported router that receives security updates

bash

# Example iptables rule on an upstream Linux gateway to block access
# to the vulnerable CGI path from untrusted clients (illustrative)
iptables -I FORWARD -p tcp -d <WF2220_IP> --dport 80 \
  -m string --algo bm --string "/cgi-bin-igd/netcore_get.cgi" \
  -j DROP