Information Disclosure in Netis E1+ via netcore_get.cgi Endpoint

Executive Summary

This vulnerability exists in the Netis E1+ device firmware version 1.2.32533. It allows unauthenticated attackers to retrieve WiFi passwords by sending a GET request to the netcore_get.cgi endpoint. Through this endpoint, attackers can extract sensitive network credentials such as the SSID and WiFi passwords in plain text.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of your WiFi network credentials. An attacker exploiting this flaw can gain access to your wireless network without authentication, potentially allowing them to intercept network traffic, access connected devices, or launch further attacks within your network.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Netis E1+ device responds to unauthenticated GET requests to the netcore_get.cgi endpoint and returns WiFi credentials in plain text.

A possible command to test this is to send a GET request to the endpoint using tools like curl or wget.

• curl http://<device-ip>/netcore_get.cgi
• wget -qO- http://<device-ip>/netcore_get.cgi

If the response contains SSID and WiFi passwords in plain text without authentication, the device is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, restrict access to the netcore_get.cgi endpoint to trusted users only.

Ensure that the device firmware is updated to a version that patches this vulnerability if available.

If firmware updates are not available, consider disabling remote management or restricting management access to trusted networks.

Change WiFi passwords after applying mitigations to prevent unauthorized access.

Useful 0 Not Useful 0