NetGear N150 WNR1000v3 Password Recovery Feature Information Disclosure Vulnerability

Bugtraq ID:	64940
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2014 12:00AM
Updated:	Jul 08 2014 12:06AM
Credit:	c1ph04text
Vulnerable:
Not Vulnerable:

NetGear N150 WNR1000v3 Password Recovery Feature Information Disclosure Vulnerability

NetGear N150 WNR1000v3 is prone to an information-disclosure vulnerability.

Successful exploits will allow unauthenticated attackers to obtain sensitive information such as administrative credentials, which may aid in further attacks.

NetGear N150 WNR1000v3 running firmware versions 1.0.2.60_60.0.86, 1.0.2.54_60.0.82NA and 1.0.2.62_60.0.87 are vulnerable.

NetGear N150 WNR1000v3 Password Recovery Feature Information Disclosure Vulnerability

The researcher of this issue has created a proof-of-concept code. Please see the references for more information.

The following exploit is available:

• /data/vulnerabilities/exploits/c1ph04

NetGear N150 WNR1000v3 Password Recovery Feature Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

NetGear N150 WNR1000v3 Password Recovery Feature Information Disclosure Vulnerability

References:

• Netgear Homepage (NetGear)