CVE-2025-3759: netcore_set.cgi Auth Bypass Vulnerability

CVE-2025-3759 Overview

CVE-2025-3759 is a missing authentication vulnerability [CWE-306] affecting the /cgi-bin-igd/netcore_set.cgi endpoint on a network device. The endpoint handles device configuration changes but is reachable without any authentication. An attacker on an adjacent network can invoke the endpoint to modify device settings directly. Reported exploitation scenarios include administrator account hijacking and access point password modification. According to CERT Poland, the vendor was contacted but did not respond to the disclosure. The vulnerability carries a CVSS 4.0 score of 8.7 and an EPSS probability of 0.226%.

Critical Impact
Unauthenticated attackers on the adjacent network can change device configuration, hijack administrator accounts, and modify wireless access point credentials.

Affected Products

Network device exposing the /cgi-bin-igd/netcore_set.cgi endpoint (specific vendor and model not disclosed in the published CVE record)
See the CERT Poland Vulnerability Post for additional product context
Vendor did not respond to disclosure; no patched product list is published

Discovery Timeline

2025-05-08 - CVE-2025-3759 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3759

Vulnerability Analysis

The vulnerability resides in the device's web management interface. The /cgi-bin-igd/netcore_set.cgi endpoint accepts configuration change requests without verifying the requester's identity. Any client able to reach the device's HTTP service can submit configuration writes, including changes to administrative credentials and wireless network settings.

The weakness is classified as Missing Authentication for Critical Function [CWE-306]. The CGI handler does not enforce session tokens, HTTP basic authentication, or any other access control before executing privileged operations. This collapses the trust boundary between unauthenticated network clients and administrative configuration functions.

Because the endpoint controls device-wide settings, exploitation yields full administrative control over the affected unit. The attack vector is Adjacent Network, meaning the attacker must be on the same broadcast domain or LAN segment as the device.

Root Cause

The root cause is the absence of an authentication check inside the netcore_set.cgi handler. Configuration-changing CGI endpoints must validate an authenticated administrative session before processing parameters. In this firmware, the handler proceeds directly to applying the supplied configuration values.

Attack Vector

An attacker connects to the device's LAN-side HTTP service and issues an HTTP request to /cgi-bin-igd/netcore_set.cgi with parameters that overwrite the administrator password or the Wi-Fi pre-shared key. No credentials, tokens, or referer checks gate the request. After the configuration is applied, the attacker authenticates with the newly set credentials and takes over device management.

No verified proof-of-concept code is published with the CVE record. Technical detail is available in the CERT Poland advisory.

Detection Methods for CVE-2025-3759

Indicators of Compromise

HTTP requests to /cgi-bin-igd/netcore_set.cgi originating from LAN clients that are not administrative workstations
Unexpected changes to administrator account credentials or recovery settings on the device
Wireless access point SSID or pre-shared key changes that were not initiated by IT staff
Device configuration backups showing parameter modifications outside of approved change windows

Detection Strategies

Inspect device access logs for POST or GET requests targeting /cgi-bin-igd/netcore_set.cgi and correlate them with authenticated admin sessions
Deploy network IDS signatures that flag requests to netcore_set.cgi from non-management VLANs
Compare periodic configuration exports against a known-good baseline to surface unauthorized modifications

Monitoring Recommendations

Forward device syslog and HTTP access logs to a centralized SIEM for retention and alerting
Alert on administrator password change events and wireless credential updates outside change-control windows
Monitor for new or unexpected client associations following any configuration change event

How to Mitigate CVE-2025-3759

Immediate Actions Required

Restrict access to the device management interface to a dedicated management VLAN or specific administrative IP addresses
Block LAN client access to /cgi-bin-igd/netcore_set.cgi using an upstream firewall or ACL where feasible
Rotate administrator credentials and wireless pre-shared keys, and verify current device configuration against a trusted baseline
Disable remote management features that are not required for operations

Patch Information

No vendor patch is referenced in the CVE record. CERT Poland reports the vendor did not respond to disclosure attempts. Operators should treat the device as unpatched and apply compensating network controls. Track the CERT Poland advisory for any future vendor response.

Workarounds

Segment affected devices onto an isolated network where only trusted administrative hosts can reach the HTTP management service
Replace affected hardware with a vendor-supported device that enforces authentication on configuration endpoints if no patch becomes available
Enforce 802.1X or MAC-based access control on the LAN to limit which clients can reach the device's adjacent network

bash

# Example firewall rule restricting access to the management CGI
# Allow only the management host 10.0.0.10 to reach the device at 192.168.1.1
iptables -A FORWARD -s 10.0.0.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP