What is the CVSS score of CVE-2019-17373?

CVE-2019-17373 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Mbr1515 Firmware CVE-2019-17373

CRITICAL

2019-10-09 cve@mitre.org

Netgear Information Disclosure Mbr1515 Firmware Mbr1516 Firmware Dgn2200 Firmware Dgn2200M Firmware Dgnd3700 Firmware Wnr2000V2 Firmware Wndr3300 Firmware Wndr3400 Firmware Wnr3500 Firmware Wnr834Bv2 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 09, 2019 - 13:15 nvd

CRITICAL 9.8

DescriptionNVD

AnalysisAI

Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2. Affected products include: Netgear Mbr1515 Firmware, Netgear Mbr1516 Firmware, Netgear Dgn2200 Firmware, Netgear Dgn2200M Firmware, Netgear Dgnd3700 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.