PT-2024-2619 · NetGear · Netgear Cbr40+1

Published 2024-03-12 · Updated 2025-05-27 · CVE-2024-28339

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Netgear CBR40 version 2.5.0.28 Netgear CBK40 version 2.5.0.28 Netgear CBK43 version 2.5.0.28

Description The issue is related to an information leak in the debuginfo.htm component, which allows attackers to obtain sensitive information without any authentication required. This is due to inadequate access control in the component. The leak can be exploited remotely.

Recommendations For Netgear CBR40 version 2.5.0.28, consider disabling access to the debuginfo.htm component until a patch is available. For Netgear CBK40 version 2.5.0.28, restrict access to the debuginfo.htm component to minimize the risk of exploitation. For Netgear CBK43 version 2.5.0.28, avoid using the debuginfo.htm component until the issue is resolved. As a temporary workaround, consider disabling the debuginfo.htm component for all affected devices until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-02686

CVE-2024-28339

Affected Products

Netgear Cbr40

Netgear Cbk43

References · 9

• 🔥 https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88debuginfo.htm%EF%BC%89.md · Exploit
• https://netgear.com/about/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02686 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28339 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28339 · Vendor Advisory
• https://vuldb.com/?id.256592 · Note
• https://twitter.com/CVEnew/status/1767600105366896773 · Twitter Post
• https://t.me/cvenotify/123706 · Telegram Post
• https://t.me/cvenotify/92480 · Telegram Post