Improper Authentication in NETGEAR products - #VU103632
Published: February 5, 2025
Vulnerability identifier: #VU103632
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.
Affected software
WAX214v2
WAX220
WAX206
WAX220
WAX206
Remediation
Install updates from vendor's website.
WAX214v2 - update to 1.0.2.5
WAX220 - update to 1.0.3.5
WAX206 - update to 1.0.5.3
WAX220 - update to 1.0.3.5
WAX206 - update to 1.0.5.3