PT-2019-15112 · NetGear · Netgear Dgnd3700+8

Z3 · Publicado 2019-10-09 · Atualizado 2020-08-24 · CVE-2019-17373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2

Description The issue allows unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg. This can be achieved by appending a specific string, such as ?x=1.jpg, to a URL.

Recommendations For NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2, consider restricting access to critical .cgi and .htm pages to prevent unauthenticated access. As a temporary workaround, avoid using URLs that can be manipulated by appending substrings ending with .jpg, such as ?x=1.jpg, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2019-17373

Produtos afetados

Netgear Dgn2200

Netgear Dgnd3700

Netgear Mbr1515

Netgear Mbr1516

Netgear Wndr3300

Netgear Wndr3400

Netgear Wnr2000V2

Netgear Wnr3500L

Netgear Wnr834Bv2

Referências · 2

• 🔥 https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17373 · Nota de Segurança