CVE-2019-14526
High
Description
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Netgear Mr1100 Firmware
PublishedAug 14, 2019
First seenAug 14, 2019
How to fix
Update
- netgear mr1100_firmware12.06.03 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netgear mr1100_firmware | v < 12.06.03 | 12.06.03 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.