CVE-2019-17372
Description
Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netgear ac1450_firmware | No range specified | — |
| netgear d8500_firmware | No range specified | — |
| netgear dc112a_firmware | No range specified | — |
| netgear jndr3000_firmware | No range specified | — |
| netgear lg2200d_firmware | No range specified | — |
| netgear r4500_firmware | No range specified | — |
| netgear r6200_firmware | No range specified | — |
| netgear r6200v2_firmware | No range specified | — |
| netgear r6250_firmware | No range specified | — |
| netgear r6300_firmware | No range specified | — |
| netgear r6300v2_firmware | No range specified | — |
| netgear r6400_firmware | No range specified | — |
| netgear r6700_firmware | No range specified | — |
| netgear r6900p_firmware | No range specified | — |
| netgear r6900_firmware | No range specified | — |
| netgear r7000p_firmware | No range specified | — |
| netgear r7000_firmware | No range specified | — |
| netgear r7100lg_firmware | No range specified | — |
| netgear r7300_firmware | No range specified | — |
| netgear r7900_firmware | No range specified | — |
| netgear r8000_firmware | No range specified | — |
| netgear r8300_firmware | No range specified | — |
| netgear r8500_firmware | No range specified | — |
| netgear wgr614v10_firmware | No range specified | — |
| netgear wn2500rpv2_firmware | No range specified | — |
| netgear wndr3400v2_firmware | No range specified | — |
| netgear wndr3700v3_firmware | No range specified | — |
| netgear wndr4000_firmware | No range specified | — |
| netgear wndr4500_firmware | No range specified | — |
| netgear wndr4500v2_firmware | No range specified | — |
| netgear wnr1000_firmware | No range specified | — |
| netgear wnr1000v3_firmware | No range specified | — |
| netgear wnr3500l_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.