CVE-2019-17372 : Certain NETGEAR devices allow remote attackers to disable all authentication req

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

Published 2019-10-09 13:15:17

Updated 2019-10-18 14:56:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2019-17372

Netgear » Wnr1000v3 Firmware » Version: N/A
cpe:2.3:o:netgear:wnr1000v3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr1000v3 » Version: N/A
Netgear » R6400 Firmware » Version: N/A
cpe:2.3:o:netgear:r6400_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6400 » Version: N/A
Netgear » R6700 Firmware » Version: N/A
cpe:2.3:o:netgear:r6700_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6700 » Version: N/A
Netgear » R6900 Firmware » Version: N/A
cpe:2.3:o:netgear:r6900_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6900 » Version: N/A
Netgear » R7000 Firmware » Version: N/A
cpe:2.3:o:netgear:r7000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7000 » Version: N/A
Netgear » R7100lg Firmware » Version: N/A
cpe:2.3:o:netgear:r7100lg_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7100lg » Version: N/A
Netgear » R7900 Firmware » Version: N/A
cpe:2.3:o:netgear:r7900_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7900 » Version: N/A
Netgear » R8000 Firmware » Version: N/A
cpe:2.3:o:netgear:r8000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8000 » Version: N/A
Netgear » R6250 Firmware » Version: N/A
cpe:2.3:o:netgear:r6250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6250 » Version: N/A
Netgear » R6200 Firmware » Version: N/A
cpe:2.3:o:netgear:r6200_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6200 » Version: N/A
Netgear » R6300 Firmware » Version: N/A
cpe:2.3:o:netgear:r6300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6300 » Version: N/A
Netgear » Ac1450 Firmware » Version: N/A
cpe:2.3:o:netgear:ac1450_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ac1450 » Version: N/A
Netgear » Wndr3700v3 Firmware » Version: N/A
cpe:2.3:o:netgear:wndr3700v3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr3700v3 » Version: N/A
Netgear » Wndr4000 Firmware » Version: N/A
cpe:2.3:o:netgear:wndr4000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr4000 » Version: N/A
Netgear » Wndr4500 Firmware » Version: N/A
cpe:2.3:o:netgear:wndr4500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr4500 » Version: N/A
Netgear » Wnr1000 Firmware » Version: N/A
cpe:2.3:o:netgear:wnr1000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr1000 » Version: N/A
Netgear » Wnr3500l Firmware » Version: N/A
cpe:2.3:o:netgear:wnr3500l_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr3500l » Version: N/A
Netgear » R8300 Firmware » Version: N/A
cpe:2.3:o:netgear:r8300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8300 » Version: N/A
Netgear » R8500 Firmware » Version: N/A
cpe:2.3:o:netgear:r8500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8500 » Version: N/A
Netgear » R7000p Firmware » Version: N/A
cpe:2.3:o:netgear:r7000p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7000p » Version: N/A
Netgear » R6900p Firmware » Version: N/A
cpe:2.3:o:netgear:r6900p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6900p » Version: N/A
Netgear » D8500 Firmware » Version: N/A
cpe:2.3:o:netgear:d8500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » D8500 » Version: N/A
Netgear » R7300 Firmware » Version: N/A
cpe:2.3:o:netgear:r7300_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7300 » Version: N/A
Netgear » Dc112a Firmware » Version: N/A
cpe:2.3:o:netgear:dc112a_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Dc112a » Version: N/A
Netgear » Jndr3000 Firmware » Version: N/A
cpe:2.3:o:netgear:jndr3000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jndr3000 » Version: N/A
Netgear » Lg2200d Firmware » Version: N/A
cpe:2.3:o:netgear:lg2200d_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Lg2200d » Version: N/A
Netgear » R4500 Firmware » Version: N/A
cpe:2.3:o:netgear:r4500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R4500 » Version: N/A
Netgear » R6200v2 Firmware » Version: N/A
cpe:2.3:o:netgear:r6200v2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6200v2 » Version: N/A
Netgear » R6300v2 Firmware » Version: N/A
cpe:2.3:o:netgear:r6300v2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6300v2 » Version: N/A
Netgear » Wgr614v10 Firmware » Version: N/A
cpe:2.3:o:netgear:wgr614v10_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wgr614v10 » Version: N/A
Netgear » Wn2500rpv2 Firmware » Version: N/A
cpe:2.3:o:netgear:wn2500rpv2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wn2500rpv2 » Version: N/A
Netgear » Wndr3400v2 Firmware » Version: N/A
cpe:2.3:o:netgear:wndr3400v2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr3400v2 » Version: N/A
Netgear » Wndr4500v2 Firmware » Version: N/A
cpe:2.3:o:netgear:wndr4500v2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr4500v2 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-17372

EPSS FAQ

1.62%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-17372

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-17372

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-17372

https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.md

CVE_Request/netgear_cgi_unauthorized_access_vulnerability.md at master · zer0yu/CVE_Request · GitHub
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2019-17372

Products affected by CVE-2019-17372

Exploit prediction scoring system (EPSS) score for CVE-2019-17372

CVSS scores for CVE-2019-17372

CWE ids for CVE-2019-17372

References for CVE-2019-17372