CVE-2017-5521

NETGEAR routers across many popular models leak the admin password through a flaw in the web management interface's password recovery flow. When a visitor cancels the login prompt and password recovery is not enabled, the router exposes a password recovery token, and requesting /passwordrecovered.cgi?id=TOKEN with that token returns the router's admin password; the flaw is reachable remotely when the remote management option is enabled, and also from the LAN or WLAN. An attacker who obtains the password gains full administrative control of the router. Owners of the affected NETGEAR models are exposed, and the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-08 with a public proof-of-concept available and an EPSS exploitation probability of ~89%, indicating active exploitation.

What to do: Apply firmware updates per NETGEAR's instructions; if an affected router has reached end-of-life, disconnect or replace it. As an interim mitigation, disable remote web management if it is not required, and note that enabling password recovery once (setting security questions) permanently blocks this exploit even if the option is later disabled. Administrators should check whether the web panel at /passwordrecovered.cgi exposes credentials when authentication is canceled.