CVE-2016-10175 Information disclosure in n/a
An attacker can retrieve the router's serial number via a specific URI, which facilitates obtaining administrator credentials when combined with another vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10175?
CVE-2016-10175 is a critical vulnerability in n/a, published on 30 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
Weakness: CWE-200
Which versions are affected by CVE-2016-10175?
It affects 1 product.
Products include Netgear Wnr2000v5 Firmware.
How do I fix CVE-2016-10175?
No fix has been published for CVE-2016-10175 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10175 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-10175 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-ghhf-xp94-4ggw.