PT-2024-4345 · NetGear · Netgear Wnr614

Published 2024-06-07 · Updated 2024-11-07 · CVE-2024-36788

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netgear WNR614 JNR1010V2 N300-V1.1.0.54 1.0.1

Description The issue is related to the improper setting of the HTTPOnly flag for cookies, allowing attackers to possibly intercept and access sensitive communications between the router and connected devices. This is due to the use of cookies to store confidential information without the HttpOnly flag. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For Netgear WNR614 JNR1010V2 N300-V1.1.0.54 1.0.1, consider updating the firmware to a version that properly sets the HTTPOnly flag for cookies as a permanent solution. As a temporary workaround, restrict access to sensitive communications between the router and connected devices to minimize the risk of exploitation.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

CWE-1004

Related Identifiers

BDU:2024-04834

CVE-2024-36788

Affected Products

Netgear Wnr614

References · 10

• 🔥 https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router · Exploit
• https://bdu.fstec.ru/vul/2024-04834 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36788 · Security Note
• https://t.me/cvenotify/100658 · Telegram Post
• https://twitter.com/zoomeye_team/status/1800353094641099088 · Twitter Post
• https://t.me/cvenotify/82314 · Telegram Post
• https://xakep.ru/2024/06/11/netgear-wnr614-n300-bugs · Note
• https://twitter.com/UndercodeNews/status/1853832091370148069 · Twitter Post
• https://vuldb.com/ru/?id.267424 · Note