Improper Authentication in NETGEAR products - #VU64829

Vulnerability identifier: #VU64829

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.

CBR40
RBK852
RBK752
RBR750
RBR850
RBS750
RBS850
CBR750

Install updates from vendor's website.

CBR40 - update to 2.5.0.28
RBK852 - update to 3.2.17.12
RBK752 - update to 3.2.17.12
RBR750 - update to 3.2.17.12
RBR850 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12
CBR750 - update to 4.6.3.6

• https://kb.netgear.com/000065032/Security-Advisory-for-Authentication-Bypass-on-Some-WiFi-Systems-PSV-2020-0489

• Improper Authentication in NETGEAR WiFi Systems