PT-2016-3879 · NetGear · Netgear D6000+1

Mandar Jadhav · Published 2016-06-20 · Updated 2016-06-21 · CVE-2015-8288

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR D3600 versions 1.0.0.49 and earlier NETGEAR D6000 versions 1.0.0.49 and earlier

Description The issue allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a hardcoded private key from another installation. This is possible because the same private key is used across different customers' installations.

Recommendations For NETGEAR D3600 version 1.0.0.49 and earlier, consider updating the firmware to a version that does not use a hardcoded private key. For NETGEAR D6000 version 1.0.0.49 and earlier, consider updating the firmware to a version that does not use a hardcoded private key. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2015-8288

Affected Products

Netgear D3600

Netgear D6000

References · 3

• http://kb.netgear.com/app/answers/detail/a_id/30560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8288 · Security Note
• http://kb.cert.org/vuls/id/778696 · Note