PT-2019-15112 · NetGear · Netgear Dgnd3700+8

Z3 · Published 2019-10-09 · Updated 2020-08-24 · CVE-2019-17373

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2

Description The issue allows unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg. This can be achieved by appending a specific string, such as ?x=1.jpg, to a URL.

Recommendations For NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2, consider restricting access to critical .cgi and .htm pages to prevent unauthenticated access. As a temporary workaround, avoid using URLs that can be manipulated by appending substrings ending with .jpg, such as ?x=1.jpg, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2019-17373

Affected Products

Netgear Dgn2200

Netgear Dgnd3700

Netgear Mbr1515

Netgear Mbr1516

Netgear Wndr3300

Netgear Wndr3400

Netgear Wnr2000V2

Netgear Wnr3500L

Netgear Wnr834Bv2

References · 2

• 🔥 https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17373 · Security Note