CVE-2020-37093
Information Disclosure in Netis E1+ via netcore_get.cgi Endpoint
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netis | e1+ | 1.2.32533 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Netis E1+ device firmware version 1.2.32533. It allows unauthenticated attackers to retrieve WiFi passwords by sending a GET request to the netcore_get.cgi endpoint. Through this endpoint, attackers can extract sensitive network credentials such as the SSID and WiFi passwords in plain text.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of your WiFi network credentials. An attacker exploiting this flaw can gain access to your wireless network without authentication, potentially allowing them to intercept network traffic, access connected devices, or launch further attacks within your network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Netis E1+ device responds to unauthenticated GET requests to the netcore_get.cgi endpoint and returns WiFi credentials in plain text.
A possible command to test this is to send a GET request to the endpoint using tools like curl or wget.
- curl http://<device-ip>/netcore_get.cgi
- wget -qO- http://<device-ip>/netcore_get.cgi
If the response contains SSID and WiFi passwords in plain text without authentication, the device is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, restrict access to the netcore_get.cgi endpoint to trusted users only.
Ensure that the device firmware is updated to a version that patches this vulnerability if available.
If firmware updates are not available, consider disabling remote management or restricting management access to trusted networks.
Change WiFi passwords after applying mitigations to prevent unauthorized access.