NETGEAR Multiple Devices Exposure of Sensitive Information
CVE-2017-5521 is a high-severity vulnerability in R6200 Firmware from NETGEAR, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected R6200 Firmware versions: 1.0.1.56_1.0.43. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on September 8, 2022, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of R6200 Firmware you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
- Read the advisory on kb.netgear.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| NETGEAR | R6200 Firmware | 1.0.1.56_1.0.43 | Not stated |
| NETGEAR | R6300 Firmware | 1.0.2.78_1.0.58 | Not stated |
| NETGEAR | Vegn2610 Firmware | 1.0.0.36 | Not stated |
| NETGEAR | Ac1450 Firmware | 1.0.0.34_10.0.16 | Not stated |
| NETGEAR | Wnr1000v3 Firmware | 1.0.2.68_60.0.93 | Not stated |
| NETGEAR | Wndr3700v3 Firmware | 1.0.0.40_1.0.32 | Not stated |
| NETGEAR | Wndr4000 Firmware | 1.0.2.4_9.1.86 | Not stated |
| NETGEAR | Wndr4500 Firmware | 1.0.1.44_1.0.73 | Not stated |
| NETGEAR | D6400 Firmware | 1.0.0.44 | Not stated |
| NETGEAR | D6220 Firmware | 1.0.0.12 | Not stated |
| NETGEAR | D6300 Firmware | 1.0.0.96 | Not stated |
| NETGEAR | D6300b Firmware | 1.0.0.40 | Not stated |
| NETGEAR | Dgn2200bv4 Firmware | 1.0.0.68 | Not stated |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.1 | High | NVD |
| CVSS 3.1 | 8.1 | High | CISA (ADP) |
| CVSS 2.0 | 4.3 | Medium | NVD |
Official description
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5521US Government Resource
Technical write-ups (may include proof of concept)
- exploit-db.com/exploits/41205/Exploit, Third Party Advisory, VDB Entry
Other vulnerabilities in R6200 Firmware
- 8.8 High severity
Spotted an error? Tell us.