CVE-2019-17372 Auth bypass in n/a
Remote attackers can bypass authentication to retrieve admin passwords on various NETGEAR routers, leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17372?
CVE-2019-17372 is a high-severity authentication bypass vulnerability in Netgear D8500 Firmware, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.
Weakness: CWE-287
Which versions are affected by CVE-2019-17372?
It affects 33 products.
Products include Netgear Ac1450 Firmware, Netgear D8500 Firmware, Netgear Dc112a Firmware, Netgear Jndr3000 Firmware, Netgear Lg2200d Firmware, Netgear R4500 Firmware and 27 more.
How do I fix CVE-2019-17372?
No fix has been published for CVE-2019-17372 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-17372 being exploited?
There is no known exploitation of CVE-2019-17372 in the wild and no public exploit code.
Other vulnerabilities in Netgear D8500 Firmware
Sources
Also known as GHSA-j647-7p9h-x2g4.