Junglewise Threat Intelligence

CVE-2016-10175: NETGEAR WNR2000 information disclosure in BRS_netgear_success.html

CVE-2016-10175 · Severity: critical · CVSS 9.8 · Published 2017-01-30

Technologies: NETGEAR Wnr2000v5 Firmware, NETGEAR WNR2000v4, NETGEAR WNR2000v3. Vendors: NETGEAR.

Executive brief

A vulnerability in several NETGEAR router models allows unauthorized individuals to view the device's serial number without logging in. This serial number is a critical piece of information that can be used to bypass security questions and reset the administrator password. If exploited, an attacker could take full control of the router, change network settings, or intercept internet traffic.

Technical details

The vulnerability is an information disclosure (CWE-200) where the web server (uhttpd) leaks the device's serial number in the JavaScript content of the /BRS_netgear_success.html URI. This leakage is significant because the serial number is used as a primary seed or validation token for password recovery mechanisms. When combined with other vulnerabilities (such as CVE-2016-10176), an unauthenticated attacker can reset the administrator password. The attack is possible over the local network (LAN) by default or over the wide area network (WAN) if remote management is enabled. NETGEAR has released firmware updates for affected models to address this and related vulnerabilities.

Affected products

  • NETGEAR WNR2000v5 All firmware versions prior to 1.0.0.42
  • NETGEAR WNR2000v4 All firmware versions prior to 1.0.0.62
  • NETGEAR WNR2000v3 All firmware versions prior to 1.0.2.14
  • NETGEAR D6100
  • NETGEAR R6220
  • NETGEAR WNDR3700v4

Timeline

  • 2016-12-20: disclosed: Initial 0-day disclosure by researcher Pedro Ribeiro
  • 2016-12-22: advisory: NETGEAR published initial security advisory PSV-2016-0255
  • 2017-01-26: patched: Production firmware released for WNR2000 series
  • 2017-01-30: advisory: CVE-2016-10175 published to NVD

References

Related threats