PT-2024-5008 · NetGear · Netgear Wn604

Published 2024-07-02 · Updated 2024-11-06 · CVE-2024-6646

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Netgear WN604 versions up to 20240710

Description: A vulnerability was found in the Web Interface component of Netgear WN604, specifically in the /downloadFile.php file. The issue is related to insufficient protection of internal data. The manipulation of the file argument with the input config leads to information disclosure. This can be exploited remotely. The vulnerability allows an attacker to disclose protected information.

Recommendations: For Netgear WN604 versions up to 20240710, as a temporary workaround, consider restricting access to the /downloadFile.php file until a patch is available. Avoid using the file argument with the input config in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-05532

CVE-2024-6646

Affected Products

Netgear Wn604

References · 10

• 🔥 https://github.com/mikutool/vul/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6646 · Security Note
• https://bdu.fstec.ru/vul/2024-05532 · Security Note
• https://vuldb.com/?submit.367382 · Note
• https://t.me/cvedetector/560 · Telegram Post
• https://vuldb.com/?ctiid.271052 · Note
• https://vuldb.com/?id.271052 · Note
• https://twitter.com/HackingTeam777/status/1854044476257272245 · Twitter Post
• https://twitter.com/CVEnew/status/1811322723756626247 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811137150282240328 · Twitter Post