CVE-2016-5649 Netgear DGN2200 and DGND3700 disclose the administrator password

2018-07-2415:00:00

CWE-319

certcc

www.cve.org

9.7 High

AI Score

Confidence

High

0.131 Low

EPSS

Percentile

95.6%

JSON

A vulnerability is in the ‘BSW_cxttongr.htm’ page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router’s web interface.

CNA Affected

[
  {
    "product": "DGN2200",
    "vendor": "Netgear",
    "versions": [
      {
        "status": "affected",
        "version": "DGN2200-V1.0.0.50_7.0.50"
      }
    ]
  },
  {
    "product": "DGND3700",
    "vendor": "Netgear",
    "versions": [
      {
        "status": "affected",
        "version": "DGND3700-V1.0.0.17_1.0.17"
      }
    ]
  }
]