CVE-2016-5638 Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877 reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text

2018-07-2415:00:00

CWE-319

certcc

www.cve.org

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.8%

JSON

There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genie_ping.htm or genie_ping2.htm or genie_ping3.htm page without authentication. Once accessed, the page will be redirected to the aCongratulations2.htma page, which reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text.

CNA Affected

[
  {
    "product": "WNDR4500",
    "vendor": "Netgear",
    "versions": [
      {
        "status": "affected",
        "version": "V1.0.1.40_1.0.6877"
      }
    ]
  }
]