CVE-2020-37093
Published: 03 February 2026
Summary
CVE-2020-37093 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Netis Systems (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).
Deeper analysis
CVE-2020-37093 is an information disclosure vulnerability (CWE-201) affecting the Netis E1+ router firmware version 1.2.32533. The issue resides in the netcore_get.cgi endpoint, which exposes sensitive WiFi credentials, including SSID and passwords, in plain text. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges, user interaction, or scope changes.
Unauthenticated attackers with network access to the affected device can exploit this vulnerability by sending a simple GET request to the netcore_get.cgi endpoint. Successful exploitation allows retrieval of plaintext WiFi passwords and associated SSIDs, potentially enabling network access, further lateral movement, or persistence on the target network.
Advisories and references include the Netis Systems vendor page (http://www.netis-systems.com), a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/48384), and a detailed advisory from Vulncheck (https://www.vulncheck.com/advisories/netis-e-unauthenticated-wifi-password-leak), which document the issue but do not specify patch availability in the provided details.
The availability of a public PoC exploit on Exploit-DB suggests potential for real-world exploitation against unpatched Netis E1+ devices.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31007
Vulnerability details
Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcore_get.cgi endpoint. Attackers can send a GET request to the endpoint to extract sensitive network credentials including SSID and WiFi passwords in…
more
plain text.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of exposed router web endpoint (T1190) yields plaintext WiFi credentials (T1552).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to prevent unauthenticated access to the netcore_get.cgi endpoint that discloses sensitive WiFi credentials in plain text.
Remediates the specific information disclosure flaw in the Netis E1+ firmware version 1.2.32533 to block retrieval of plaintext WiFi passwords.
Monitors system activity to identify unauthorized disclosures of WiFi credentials through the vulnerable netcore_get.cgi endpoint.