CVE-2017-5521: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

CISA Known Exploited Vulnerability (KEV)

Description

Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.

Required action (CISA)

Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.

Notes

https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2017-5521

Weakness behind it

CISA records this vulnerability as an instance of CWE-200. From there the chain continues into CAPEC attack patterns and ATT&CK techniques, all inside this corpus.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-5521
• KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog