Netis Systems WF2220 Missing Authentication Vulnerability in Configuration Management Endpoint

A vulnerability exists in the Netis Systems WF2220 router, specifically in version 1.2.31706. The issue arises from the endpoint '/cgi-bin-igd/netcore_set.cgi', which is used for changing device configurations. This endpoint is accessible without authentication, allowing unauthorized users to modify settings such as the administrator account or access point password. The vulnerability is classified as 'Missing Authentication for Critical Function' (CWE-306).

Impact

Exploitation of this vulnerability could lead to unauthorized changes in device configuration, such as hijacking the administrator account or altering the access point password.