CVE-2017-5521

NETGEAR Multiple Devices: Exposure of Sensitive Information

As of , CVE-2017-5521 in NETGEAR Multiple Devices is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 8 September 2022
US federal deadline
29 September 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.89Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.90 on 8 September 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module and 1 Exploit-DB entry (1 verified)
Fix
Vendor advice: kb.netgear.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.

CISA's required action

What the flaw is

Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.

CISA's description

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

The CVE record's description, from mitre

CVE published
17 January 2017
Assigned by
mitre
CVSS
8.1 High (CVSS 3.1, from CISA-ADP)
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 41205).
  3. CISA added it to its list of exploited vulnerabilities.
  4. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

Multiple Devices: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2017-6862Buffer OverflowNETGEAR Multiple DevicesPatch soon0.46

Read further