Information disclosure in NETGEAR products - #VU61927

Vulnerability identifier: #VU61927

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.

R6120
R6260
R6330
R6350
R6850
R6220
R6230
AC2100
AC2400
AC2600
R6700v2
R6900v2
R7200
R7350
R7400
R7450

Install updates from vendor's website.

R6120 - update to 1.0.0.82
R6260 - update to 1.1.0.86
R6330 - update to 1.1.0.86
R6350 - update to 1.1.0.86
R6850 - update to 1.1.0.86
R6220 - update to 1.1.0.112
R6230 - update to 1.1.0.112
AC2100 - update to 1.2.0.90
AC2400 - update to 1.2.0.90
AC2600 - update to 1.2.0.90
R6700v2 - update to 1.2.0.90
R6900v2 - update to 1.2.0.90
R7200 - update to 1.2.0.90
R7350 - update to 1.2.0.90
R7400 - update to 1.2.0.90
R7450 - update to 1.2.0.90

• https://kb.netgear.com/000064819/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2021-0317

• Information disclosure in NETGEAR Routers