PT-2019-15111 · NetGear · Netgear
Z3
·
Publicado
2019-10-09
·
Atualizado
2019-10-18
·
CVE-2019-17372
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
NETGEAR devices versions AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, WNR3500L.
Description
The issue allows remote attackers to disable all authentication requirements by visiting "genieDisableLanChanged.cgi". After that, an attacker can visit "MNU accessPassword recovered.html" to obtain a valid new admin password.
Recommendations
For all affected NETGEAR devices, consider restricting access to the "genieDisableLanChanged.cgi" endpoint until a patch is available.
As a temporary workaround, avoid using the affected devices for sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Netgear