Information disclosure in NETGEAR products - #VU70566

Vulnerability identifier: #VU70566

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-200

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker on the local network can gain unauthorized access to sensitive information on the system.

RAX70
RAX78
R6700AX
RAX10
RBK352
RBR350
RBK762S
RBR760
RBS760

Install updates from vendor's website.

RAX70 - update to 1.0.12.114
RAX78 - update to 1.0.12.114
R6700AX - update to 1.0.12.114
RAX10 - update to 1.0.12.114
RBK352 - update to 4.4.1.29
RBR350 - update to 4.4.1.29
RBK762S - update to 6.3.6.2
RBR760 - update to 6.3.6.2
RBS760 - update to 6.3.6.2

• https://kb.netgear.com/000065476/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-WiFi-Systems-PSV-2020-0428

• Information disclosure in NETGEAR Routers and WiFi Systems