Netgear WPN824v3 Unauthorized Config Download

`Title:  
======  
Netgear WPN824v3 Unauthorized Config Download  
  
Date:  
=====  
2013-06-03  
  
Introduction:  
=============  
The Netgear RangeMax Wireless Router (model WPN824v3) allows to download  
the config file without authorization.  
  
Status:  
========  
Published  
  
Affected Products:  
==================  
Netgear WPN824v3  
  
Vendor Homepage:  
================  
http://support.netgear.com/product/WPN824v3  
  
Exploitation-Technique:  
=======================  
Local and Remote  
  
Details:  
========  
I found a bug in the Netgear WPN824v3 wireless router, everyone is able  
to download the full config file without authorization.  
Unfortunately the config file is not htaccess protected.  
Tested with latest firmware V1.0.8_1.0.6.  
  
Proof of Concept:  
=================  
The vulnerability can be exploited with your browser:  
  
http://[local-ip]/cgi-bin/NETGEAR_wpn824v3.cfg  
  
If remote management is enabled:  
  
http://[remote-ip]:8080/cgi-bin/NETGEAR_wpn824v3.cfg  
  
Workaround:  
=========  
Disable the remote management feature!  
  
Author:  
========  
Jens Regel <[email protected]>  
`