CVE-2019-17372
PoC —CVSS 3.1
8.1 high
EPSS
2%p75
Published
()
Modified
Description
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.
- Vendors
- netgear
- Products
- ac1450 firmware, d8500 firmware, dc112a firmware, jndr3000 firmware, lg2200d firmware, r4500 firmware, r6200 firmware, r6200v2 firmware, r6250 firmware, r6300 firmware, r6300v2 firmware, r6400 firmware
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.