Security features bypass in NETGEAR Routers
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | N/A |
| CWE-ID | CWE-254 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
R6400v2 Hardware solutions / Routers for home users R7000 Hardware solutions / Routers for home users R7000P Hardware solutions / Routers for home users R8500 Hardware solutions / Routers for home users |
| Vendor | NETGEAR |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Security features bypass
EUVDB-ID: #VU62043
Risk: Medium
CVSSv4.0: 6.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: N/A
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to security misconfiguration issue. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsR6400v2: before 1.0.4.118
R7000: before 1.0.11.126
R7000P: before 1.3.3.140
R8500: before 1.0.2.154
CPE2.3- cpe:2.3:h:netgear:r6400v2:*:*:*:*:*:*:*:*
- cpe:2.3:h:netgear:r7000:*:*:*:*:*:*:*:*
- cpe:2.3:h:netgear:r7000p:*:*:*:*:*:*:*:*
- cpe:2.3:h:netgear:r8500:*:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
