PT-2024-2618 · NetGear · Netgear Cbr40+1

Published 2024-03-12 · Updated 2025-05-27 · CVE-2024-28340

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netgear CBR40 version 2.5.0.28 Netgear CBK40 version 2.5.0.28 Netgear CBK43 version 2.5.0.28

Description The issue is related to an information leak in the currentsetting.htm component, which allows attackers to obtain sensitive information without any authentication required. This is due to inadequate access control in the web interface of the affected Netgear routers. Exploitation of this issue may allow a remote attacker to disclose protected information or cause a denial of service.

Recommendations For Netgear CBR40 version 2.5.0.28, consider disabling access to the currentsetting.htm component until a patch is available. For Netgear CBK40 version 2.5.0.28, restrict access to the currentsetting.htm component to minimize the risk of exploitation. For Netgear CBK43 version 2.5.0.28, avoid using the currentsetting.htm component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-02685

CVE-2024-28340

Affected Products

Netgear Cbr40

Netgear Cbk43

References · 8

• 🔥 https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.htm%EF%BC%89.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-28340 · Vendor Advisory
• https://netgear.com/about/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28340 · Security Note
• https://bdu.fstec.ru/vul/2024-02685 · Security Note
• https://t.me/cvenotify/123707 · Telegram Post
• https://t.me/cvenotify/91592 · Telegram Post
• https://twitter.com/CVEnew/status/1767600106369364233 · Twitter Post