NetGear WNDAP350 Wireless Access Point Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	48085
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2011 12:00AM
Updated:	Jun 01 2011 12:00AM
Credit:	Juerd Waalboer
Vulnerable:	NetGear WNDAP350 Firmware 2.0.9 NetGear WNDAP350 Firmware 2.0.1
Not Vulnerable:

NetGear WNDAP350 Wireless Access Point Multiple Information Disclosure Vulnerabilities

NetGear WNDAP350 wireless access point is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information.

A remote attacker can exploit these issues to obtain sensitive information that can aid in launching further attacks.

WNDAP350 with firmware 2.0.1 and 2.0.9 are vulnerable; other firmware versions may also be affected.

NetGear WNDAP350 Wireless Access Point Multiple Information Disclosure Vulnerabilities

An attacker may exploit these issues via a web browser.

The following example URIs are available:

http://www.example.com/downloadFile.php
http://www.example.com/BackupConfig.php

NetGear WNDAP350 Wireless Access Point Multiple Information Disclosure Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NetGear WNDAP350 Wireless Access Point Multiple Information Disclosure Vulnerabilities

References:

• Homepage (Netgear)
  
• Netgear WNDAP350 root password leak (Juerd Waalboer)