Design/Logic Flaw

2020-05-1816:15:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote leak of sensitive/arbitrary Wi-Fi information, such as SSIDs and Pre-Shared-Keys (PSK).

CPENameOperatorVersion
rbs50y_firmwareeq2.5.1.106
srr60_firmwareeq2.5.1.106
srs60_firmwareeq2.5.1.106

Name	Operator	Version
rbs50y_firmware	eq	2.5.1.106
srr60_firmware	eq	2.5.1.106
srs60_firmware	eq	2.5.1.106

References

github.com/modzero/MZ-20-02-NETGEAR-Orbi-Security

www.modzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt

www.modzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html