Improper Authentication in NETGEAR products - #VU56360

Vulnerability identifier: #VU56360

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-287

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A local attacker can hijack the session bootstrapping information and gain full access to the target device.

GS750E
GS310TP
GS308T
GS716TPP
MS510TXUP
MS510TXM
GS716TP
GS110TUP
GS710TUP
GC108P
GC108PP
GS724TPP
GS724TPv2
GS728TPPv2
GS728TPv2
GS752TPP
GS752TPv2
GS110TPv3
GS110TPP
GS108Tv3

Install updates from vendor's website.

GS750E - update to 1.0.1.10
GS310TP - update to 1.0.3.2
GS308T - update to 1.0.3.2
GS716TPP - update to 1.0.4.2
MS510TXUP - update to 1.0.4.2
MS510TXM - update to 1.0.4.2
GS716TP - update to 1.0.4.2
GS110TUP - update to 1.0.5.3
GS710TUP - update to 1.0.5.3
GC108P - update to 1.0.8.2
GC108PP - update to 1.0.8.2
GS724TPP - update to 2.0.6.3
GS724TPv2 - update to 2.0.6.3
GS728TPPv2 - update to 6.0.8.2
GS728TPv2 - update to 6.0.8.2
GS752TPP - update to 6.0.8.2
GS752TPv2 - update to 6.0.8.2
GS110TPv3 - update to 7.0.7.2
GS110TPP - update to 7.0.7.2
GS108Tv3 - update to 7.0.7.2

• https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145
• https://gynvael.coldwind.pl/?id=741

• Multiple vulnerabilities in several NETGEAR Switches