Strix
26.1K

CVE-2017-5521

HIGHCVSS 8.1/10Actively ExploitedEPSS 89.29%

Last modified

CVE-2017-5521 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. CISA has confirmed active exploitation in the wild. EPSS estimates a 89.29% chance of exploitation in the next 30 days.

Description

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
89.29%

99.8th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Affected Software

VendorProductVersions
NetgearR6200 Firmware1.0.1.56_1.0.43
NetgearR6300 Firmware1.0.2.78_1.0.58
NetgearVegn2610 Firmware1.0.0.36
NetgearAc1450 Firmware1.0.0.34_10.0.16
NetgearWnr1000v3 Firmware1.0.2.68_60.0.93
NetgearWndr3700v3 Firmware1.0.0.40_1.0.32
NetgearWndr4000 Firmware1.0.2.4_9.1.86
NetgearWndr4500 Firmware1.0.1.44_1.0.73
NetgearD6400 Firmware1.0.0.44
NetgearD6220 Firmware1.0.0.12
NetgearD6300 Firmware1.0.0.96
NetgearD6300b Firmware1.0.0.40
NetgearDgn2200bv4 Firmware1.0.0.68

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2017-5521?
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
How severe is CVE-2017-5521?
CVE-2017-5521 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 89.29% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2017-5521?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2017

View all 2017CVEs →

Are you affected by CVE-2017-5521?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST