CVE-2016-5649 - OpenCVE

A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Netgear	Dgn2200 Dgn2200 Firmware Dgnd3700 Dgnd3700 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html
https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2018-07-24T15:00:00

Updated: 2024-08-06T01:08:00.436Z

Reserved: 2016-06-16T00:00:00

Link: CVE-2016-5649

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-07-24T15:29:00.280

Modified: 2019-10-09T23:18:54.143

Link: CVE-2016-5649

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "DGN2200", "vendor": "Netgear", "versions": [{"status": "affected", "version": "DGN2200-V1.0.0.50_7.0.50"}]}, {"product": "DGND3700", "vendor": "Netgear", "versions": [{"status": "affected", "version": "DGND3700-V1.0.0.17_1.0.17"}]}], "datePublic": "2017-01-03T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-04-30T17:06:08", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html"}], "solutions": [{"lang": "en", "value": "Netgear has released firmware version 1.0.0.52 for DGN2200 & 1.0.0.28 for DGND3700 to address this issue."}], "source": {"discovery": "UNKNOWN"}, "title": "Netgear DGN2200 and DGND3700 disclose the administrator password", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2016-5649", "STATE": "PUBLIC", "TITLE": "Netgear DGN2200 and DGND3700 disclose the administrator password"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "DGN2200", "version": {"version_data": [{"affected": "=", "version_affected": "=", "version_name": "DGN2200-V1.0.0.50_7.0.50", "version_value": "DGN2200-V1.0.0.50_7.0.50"}]}}, {"product_name": "DGND3700", "version": {"version_data": [{"affected": "=", "version_affected": "=", "version_name": "DGND3700-V1.0.0.17_1.0.17", "version_value": "DGND3700-V1.0.0.17_1.0.17"}]}}]}, "vendor_name": "Netgear"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-319"}]}]}, "references": {"reference_data": [{"name": "https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html", "refsource": "MISC", "url": "https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html"}, {"name": "http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html"}]}, "solution": [{"lang": "en", "value": "Netgear has released firmware version 1.0.0.52 for DGN2200 & 1.0.0.28 for DGND3700 to address this issue."}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:08:00.436Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2016-5649", "datePublished": "2018-07-24T15:00:00", "dateReserved": "2016-06-16T00:00:00", "dateUpdated": "2024-08-06T01:08:00.436Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:*", "matchCriteriaId": "80499893-9115-49DD-95B9-86FB0DCBA8B7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:*", "matchCriteriaId": "37C89394-ED7D-4C5F-9573-47A0378E22C8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "9EDC70D5-1652-4EBD-9ADE-83B3B5AD6861", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:*", "matchCriteriaId": "AEC17F51-BDB8-4B30-B5E9-557CBDFDE785", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface."}, {"lang": "es", "value": "Hay una vulnerabilidad en la p\u00e1gina \"BSW_cxttongr.htm\" de Netgear DGN2200, en su versi\u00f3n DGN2200-V1.0.0.50_7.0.50 y DGND3700, en su versi\u00f3n DGND3700-V1.0.0.17_1.0.17, que puede permitir que un atacante remoto acceda a esta p\u00e1gina sin ning\u00fan tipo de autenticaci\u00f3n. Al procesarse, expone la contrase\u00f1a de administrador en texto claro antes de que se redirija a absw_vfysucc.cgia. Un atacante puede emplear esta contrase\u00f1a para obtener acceso de administrador a la interfaz web del router objetivo."}], "id": "CVE-2016-5649", "lastModified": "2019-10-09T23:18:54.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-24T15:29:00.280", "references": [{"source": "cret@cert.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "cret@cert.org", "type": "Secondary"}]}