CVE-2019-17372

moderate-risk

Published 2019-10-09

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

Do I need to act?

0.51% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (20)

Ac1450 Firmware

D8500 Firmware

Dc112A Firmware

Jndr3000 Firmware

Lg2200D Firmware

R4500 Firmware

R6200 Firmware

R6200V2 Firmware

R6250 Firmware

R6300 Firmware

R6300V2 Firmware

R6400 Firmware

R6700 Firmware

R6900P Firmware

R6900 Firmware

R7000P Firmware

R7000 Firmware

R7100Lg Firmware

R7300 Firmware

R7900 Firmware

Affected Vendors

Netgear

References (2)

Exploit https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthoriz...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 23/34 · High