CVE-2019-17373 Auth bypass in n/a

What is CVE-2019-17373?

CVE-2019-17373 is a critical authentication bypass vulnerability in n/a, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2.

Which versions are affected by CVE-2019-17373?

It affects 10 products.

Products include Netgear Dgn2200 Firmware, Netgear Dgn2200m Firmware, Netgear Dgnd3700 Firmware, Netgear Mbr1515 Firmware, Netgear Mbr1516 Firmware, Netgear Wndr3300 Firmware and 4 more.

How do I fix CVE-2019-17373?

No fix has been published for CVE-2019-17373 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-17373 being exploited?

There is no known exploitation of CVE-2019-17373 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-6077 NETGEAR DGN2200 Remote Code Execution Exploited Critical 9.8
• CVE-2016-5649 Netgear DGN2200 and DGND3700 disclose the administrator password Critical 9.8
• CVE-2024-57046 Auth bypass in n/a High 8.8
• CVE-2017-18755 Cross-site request forgery in n/a High 8.8
• CVE-2017-6366 Cross-site request forgery in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4fxh-vgp4-mp85.