CVE-2019-17372

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

• CWE-287

• https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.mdExploit, Third Party Advisory
• https://github.com/zer0yu/CVE_Request/blob/master/netgear/netgear_cgi_unauthorized_access_vulnerability.mdExploit, Third Party Advisory

Published

Oct 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17367OpenWRT firmware version 18.06.4 is vulnerable to CSRF via w…8.8
• CVE-2019-17368S-CMS v1.5 has XSS in tpl.php via the member/member_login.ph…6.1
• CVE-2019-17369OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Pane…6.5
• CVE-2019-1737A vulnerability in the processing of IP Service Level Agreem…8.6
• CVE-2019-17370OTCMS v3.85 allows arbitrary PHP Code Execution because admi…7.2
• CVE-2019-17371gif2png 2.5.13 has a memory leak in the writefile function.6.5
• CVE-2019-17373Certain NETGEAR devices allow unauthenticated access to crit…9.8
• CVE-2019-17375cPanel before 82.0.15 allows API token credentials to persis…8.8
• CVE-2019-17376cPanel before 82.0.15 allows self XSS in the SSL Certificate…6.1
• CVE-2019-17377cPanel before 82.0.15 allows self XSS in LiveAPI example scr…6.1
• CVE-2019-17378cPanel before 82.0.15 allows self XSS in the SSL Key Delete …6.1
• CVE-2019-17379cPanel before 82.0.15 allows self stored XSS in the WHM SSL …6.1