What is the CVSS score of CVE-2019-17372?

CVE-2019-17372 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.7%.

Is there a public PoC exploit available for CVE-2019-17372?

Yes, a public proof-of-concept exploit is available for CVE-2019-17372. Prioritise patching immediately. EPSS: 1.7%.

Ac1450 Firmware CVE-2019-17372

HIGH

Improper Authentication (CWE-287)

2019-10-09 cve@mitre.org

Netgear Authentication Bypass Ac1450 Firmware D8500 Firmware Dc112A Firmware Jndr3000 Firmware Lg2200D Firmware R4500 Firmware R6200 Firmware R6200V2 Firmware R6250 Firmware R6300 Firmware R6300V2 Firmware R6400 Firmware R6700 Firmware R6900P Firmware R6900 Firmware R7000P Firmware R7000 Firmware R7100Lg Firmware R7300 Firmware R7900 Firmware R8000 Firmware R8300 Firmware R8500 Firmware Wgr614V10 Firmware Wn2500Rpv2 Firmware Wndr3400V2 Firmware Wndr3700V3 Firmware Wndr4000 Firmware Wndr4500 Firmware Wndr4500V2 Firmware Wnr1000 Firmware Wnr1000V3 Firmware Wnr3500L Firmware

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 09, 2019 - 13:15 nvd

HIGH 8.1

DescriptionNVD

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

AnalysisAI

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L. Affected products include: Netgear Ac1450 Firmware, Netgear D8500 Firmware, Netgear Dc112A Firmware, Netgear Jndr3000 Firmware, Netgear Lg2200D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.