Improper Authentication in NETGEAR products - #VU49686

Vulnerability identifier: #VU49686

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote administrator on the local network can bypass authentication process and gain unauthorized access to the application.

R6080
R6020
R6120
R6850
R6350
R6330
R6260
R6230
R6220
R7450
AC2100
R7400
R7350
R7200
R6900v2
R6800
R6700v2
AC2600
AC2400

Install updates from vendor's website.

R6080 - update to 1.0.0.48
R6020 - update to 1.0.0.48
R6120 - update to 1.0.0.76
R6850 - update to 1.1.0.78
R6350 - update to 1.1.0.78
R6330 - update to 1.1.0.78
R6260 - update to 1.1.0.78
R6230 - update to 1.1.0.104
R6220 - update to 1.1.0.104
R7450 - update to 1.2.0.76
AC2100 - update to 1.2.0.76
R7400 - update to 1.2.0.76
R7350 - update to 1.2.0.76
R7200 - update to 1.2.0.76
R6900v2 - update to 1.2.0.76
R6800 - update to 1.2.0.76
R6700v2 - update to 1.2.0.76
AC2600 - update to 1.2.0.76
AC2400 - update to 1.2.0.76

• https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Rou...

• Multiple vulnerabilities in NETGEAR Routers