Information disclosure in NETGEAR products - #VU64821

Vulnerability identifier: #VU64821

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-200

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker on the local network can gain unauthorized access to sensitive information on the system.

XR700
D7800
R7800
R9000
R8900
RAX10
RAX70
RAX120v2
RAX120
XR450
XR500
LBR1020
LBR20
RBK12
RBR40
RBK40
RBK50
RBR10
RBR20
RBR50
RBS10
RBS20
RBS40
RBS50
RBK22

Install updates from vendor's website.

XR700 - update to 1.0.1.44
D7800 - update to 1.0.1.64
R7800 - update to 1.0.2.84
R9000 - update to 1.0.5.36
R8900 - update to 1.0.5.36
RAX10 - update to 1.0.5.108
RAX70 - update to 1.0.5.108
RAX120v2 - update to 1.2.2.24
RAX120 - update to 1.2.2.24
XR450 - update to 2.3.2.130
XR500 - update to 2.3.2.130
LBR1020 - update to 2.6.5.16
LBR20 - update to 2.6.5.32
RBK12 - update to 2.7.4.24
RBR40 - update to 2.7.4.24
RBK40 - update to 2.7.4.24
RBK50 - update to 2.7.4.24
RBR10 - update to 2.7.4.24
RBR20 - update to 2.7.4.24
RBR50 - update to 2.7.4.24
RBS10 - update to 2.7.4.24
RBS20 - update to 2.7.4.24
RBS40 - update to 2.7.4.24
RBS50 - update to 2.7.4.24
RBK22 - update to 2.7.4.24

• https://kb.netgear.com/000065039/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-WiFi-system-PSV-2021-0006

• Information disclosure in NETGEAR Routers and WiFi system