Medium May 26, 2012
Netgear Information Disclosure
Several NETGEAR devices expose /currentsetting.htm without authentication, leaking the device model, firmware version, and other metadata that lets an attacker fingerprint the router before launching model-specific exploits.
CVSS Score
5.3 / 10.0
Severity
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Advisory
| Vendor | NETGEAR |
| Models | DGND3300v2, WNR2000v2, DGN1000, N300 |
| Firmware | V2.1.00.48_1.00.48, V1.1.0.41WW, V1.0.0.34_29.0.45NA |
| Impact | Reveals model, firmware, and other device metadata |
| Attack Vector | Remote, no authentication required |
Description
Several NETGEAR devices expose /currentsetting.htm without authentication. The page returns the device model, firmware version, and other information that helps an attacker fingerprint the device before targeting it with model-specific exploits.
Remediation
No vendor fix. Restrict remote management to trusted networks.