CVE-2020-37093
Unknown Unknown - Not Provided
Information Disclosure in Netis E1+ via netcore_get.cgi Endpoint

Publication date: 2026-02-03

Last updated on: 2026-02-03

Assigner: VulnCheck

Description
Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.cgi endpoint. Attackers can send a GET request to the endpoint to extract sensitive network credentials including SSID and WiFi passwords in plain text.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-02-03
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2020-37093
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
netis e1+ 1.2.32533
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Netis E1+ device firmware version 1.2.32533. It allows unauthenticated attackers to retrieve WiFi passwords by sending a GET request to the netcore_get.cgi endpoint. Through this endpoint, attackers can extract sensitive network credentials such as the SSID and WiFi passwords in plain text.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of your WiFi network credentials. An attacker exploiting this flaw can gain access to your wireless network without authentication, potentially allowing them to intercept network traffic, access connected devices, or launch further attacks within your network.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by checking if the Netis E1+ device responds to unauthenticated GET requests to the netcore_get.cgi endpoint and returns WiFi credentials in plain text.

A possible command to test this is to send a GET request to the endpoint using tools like curl or wget.

  • curl http://<device-ip>/netcore_get.cgi
  • wget -qO- http://<device-ip>/netcore_get.cgi

If the response contains SSID and WiFi passwords in plain text without authentication, the device is vulnerable.

Mitigation Strategies

To mitigate this vulnerability immediately, restrict access to the netcore_get.cgi endpoint to trusted users only.

Ensure that the device firmware is updated to a version that patches this vulnerability if available.

If firmware updates are not available, consider disabling remote management or restricting management access to trusted networks.

Change WiFi passwords after applying mitigations to prevent unauthorized access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-37093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart