NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability

Bugtraq ID:	36094
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 20 2009 12:00AM
Updated:	Aug 21 2009 03:57PM
Credit:	Jean Trolleur
Vulnerable:	NetGear WNR2000 Firmware 1.2.0.8
Not Vulnerable:

NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability

The NetGear WNR2000 router is prone to an authentication-bypass vulnerability because it fails to authenticate users trying to access specific administration applications.

Successful attacks will lead to a compromise of the vulnerable device, which may lead to further attacks.

NetGear WNR2000 running firmware 1.2.0.8 is vulnerable; other versions may also be affected.

NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability

References:

• Authentication bypass on Netgear WNR2000 (Jean Trolleur)
  
• Information disclosure on Netgear WNR2000 (Jean Trolleur)
  
• WNR2000 Homepage (Netgear)