PT-2016-3879 · NetGear · Netgear D6000+1

Mandar Jadhav · Publicado 2016-06-20 · Atualizado 2016-06-21 · CVE-2015-8288

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR D3600 versions 1.0.0.49 and earlier NETGEAR D6000 versions 1.0.0.49 and earlier

Description The issue allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a hardcoded private key from another installation. This is possible because the same private key is used across different customers' installations.

Recommendations For NETGEAR D3600 version 1.0.0.49 and earlier, consider updating the firmware to a version that does not use a hardcoded private key. For NETGEAR D6000 version 1.0.0.49 and earlier, consider updating the firmware to a version that does not use a hardcoded private key. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2015-8288

Produtos afetados

Netgear D3600

Netgear D6000

Referências · 3

• http://kb.netgear.com/app/answers/detail/a_id/30560 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/778696 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8288 · Nota de Segurança