CVE-2016-11014 : NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because th

NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.

Published 2019-10-16 11:15:13

Updated 2020-11-10 19:40:24

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2016-11014

Netgear » Jnr1010 Firmware
Versions before (<) 1.0.0.32
cpe:2.3:o:netgear:jnr1010_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jnr1010 » Version: N/A

EPSS FAQ

8.46%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Assigned by: nvd@nist.gov (Primary)

https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html

Netgear 1.0.0.24 Bypass / Improper Session Management ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html

Netgear 1.0.0.24 Bypass Improper Session Management
Exploit;Third Party Advisory
https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html

CVE-2016-11014 - Authentication Bypass in Netgear Router
Exploit;Third Party Advisory
https://github.com/cybersecurityworks/Disclosed/issues/14

Authentication Bypass in Netgear Router JNR1010 Version 1.0.0.24 · Issue #14 · cybersecurityworks/Disclosed · GitHub
Exploit;Third Party Advisory
https://lists.openwall.net/full-disclosure/2016/01/11/5

full-disclosure - [FD] Broken Authentication & Improper Session Management in Netgear Router JNR1010 Version 1.0.0.24
Exploit;Mailing List;Third Party Advisory

Jump to