Executive brief
Multiple NETGEAR routers are vulnerable to admin password disclosure when password recovery is not enabled. An attacker can obtain a recovery token by canceling authentication and then use that token via a crafted request to /passwordrecovered.cgi to retrieve the administrator password.
Affected products
- NETGEAR R8500
- NETGEAR R8300
- NETGEAR R7000
- NETGEAR R6400
- NETGEAR R7300
- NETGEAR R7100LG
- NETGEAR R6300v2
- NETGEAR WNDR3400v3
- NETGEAR WNR3500Lv2
- NETGEAR R6250
- NETGEAR R6700
- NETGEAR R6900
- NETGEAR R8000
Timeline
- 2017-01-19: disclosed: SecurityFocus BID 95457 published
- 2022-09-08: kev added: Added to CISA Known Exploited Vulnerabilities Catalog