CVE-2019-17372

Home/CVE/Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanCha

CVE

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanCha

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

HIGH · CVSS 8.1 EPSS 0.0051

Act now

Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

⬡

Weakness Classification

CWE-287Improper Authentication

▤

Affected Products & Versions

netgear ac1450 firmwareall versions
netgear d8500 firmwareall versions
netgear dc112a firmwareall versions
netgear jndr3000 firmwareall versions
netgear lg2200d firmwareall versions
netgear r4500 firmwareall versions
netgear r6200 firmwareall versions
netgear r6200v2 firmwareall versions
Show all 33 affected productsnetgear r6250 firmwareall versions
netgear r6300 firmwareall versions
netgear r6300v2 firmwareall versions
netgear r6400 firmwareall versions
netgear r6700 firmwareall versions
netgear r6900p firmwareall versions
netgear r6900 firmwareall versions
netgear r7000p firmwareall versions
netgear r7000 firmwareall versions
netgear r7100lg firmwareall versions
netgear r7300 firmwareall versions
netgear r7900 firmwareall versions
netgear r8000 firmwareall versions
netgear r8300 firmwareall versions
netgear r8500 firmwareall versions
netgear wgr614v10 firmwareall versions
netgear wn2500rpv2 firmwareall versions
netgear wndr3400v2 firmwareall versions
netgear wndr3700v3 firmwareall versions
netgear wndr4000 firmwareall versions
netgear wndr4500 firmwareall versions
netgear wndr4500v2 firmwareall versions
netgear wnr1000 firmwareall versions
netgear wnr1000v3 firmwareall versions
netgear wnr3500l firmwareall versions

⚠

Public Exploits & PoCs

pocgithub.com · netgear_cgi_unauthorized_access_vulnerability.mdgithub.com

▣

Scoring & Timeline

8.1

HIGH · CVSS v3.1 · cve@mitre.org

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD09 Oct 2019 · 01:15 PM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin