Lucene search

CertccCVE-2016-5649

HistoryJul 24, 2018 - 3:29 p.m.

CVE-2016-5649

2018-07-2415:29:00

CWE-200

CWE-319

certcc

web.nvd.nist.gov

cve-2016-5649

netgear

dgn2200

dgnd3700

vulnerability

remote attacker

authentication

admin password

clear text

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.131

Percentile

95.6%

JSON

A vulnerability is in the ‘BSW_cxttongr.htm’ page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router’s web interface.

Affected configurations

Nvd

Node

netgeardgn2200_firmwareMatch1.0.0.50_7.0.50

AND

netgeardgn2200Match-

Node

netgeardgnd3700_firmwareMatch1.0.0.17_1.0.17

AND

netgeardgnd3700Match-

VendorProductVersionCPE
netgeardgn2200_firmware1.0.0.50_7.0.50cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:*
netgeardgn2200-cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*
netgeardgnd3700_firmware1.0.0.17_1.0.17cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:*
netgeardgnd3700-cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	dgn2200_firmware	1.0.0.50_7.0.50	cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:::::::*
netgear	dgn2200	-	cpe:2.3:h:netgear:dgn2200:-:::::::*
netgear	dgnd3700_firmware	1.0.0.17_1.0.17	cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:::::::*
netgear	dgnd3700	-	cpe:2.3:h:netgear:dgnd3700:-:::::::*

CNA Affected

[
  {
    "product": "DGN2200",
    "vendor": "Netgear",
    "versions": [
      {
        "status": "affected",
        "version": "DGN2200-V1.0.0.50_7.0.50"
      }
    ]
  },
  {
    "product": "DGND3700",
    "vendor": "Netgear",
    "versions": [
      {
        "status": "affected",
        "version": "DGND3700-V1.0.0.17_1.0.17"
      }
    ]
  }
]