CVE-2025-3758

WF2220 exposes endpoint/cgi-bin-igd/netcore_get.cgithat returns configuration of the device to unauthorized users. Returned configuration includes cleartext password.
The vendor was contacted early about this disclosure but did not respond in any way.