CVE-2019-17372 - CVE House
Back to Database
Status published High CVE-2019-17372

Certain NETGEAR devices allow remote attackers to disable all authentication...

Vulnerability Description

Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for example, visit MNU_accessPassword_recovered.html to obtain a valid new admin password. This affects AC1450, D8500, DC112A, JNDR3000, LG2200D, R4500, R6200, R6200V2, R6250, R6300, R6300v2, R6400, R6700, R6900P, R6900, R7000P, R7000, R7100LG, R7300, R7900, R8000, R8300, R8500, WGR614v10, WN2500RPv2, WNDR3400v2, WNDR3700v3, WNDR4000, WNDR4500, WNDR4500v2, WNR1000, WNR1000v3, WNR3500L, and WNR3500L.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17372

Credits & Attribution

No credits recorded in the NVD database.

References

More from netgear

View All →
CVE-2022-48322
NETGEAR Nighthawk WiFi Mesh systems and routers are affected by...
Unknown 0
CVE-2022-48196
Certain NETGEAR devices are affected by a buffer overflow by...
High 7.4
CVE-2022-48176
Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before...
Unknown 0
CVE-2022-47052
The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi...
Unknown 0
CVE-2022-46424
An exploitable firmware modification vulnerability was discovered on the Netgear...
Unknown 0

Affected Vendor

Affected Software

ac1450 firmware, d8500 firmware, dc112a firmware, jndr3000 firmware, lg2200d firmware, r4500 firmware, r6200 firmware, r6200v2 firmware, r6250 firmware, r6300 firmware, r6300v2 firmware, r6400 firmware, r6700 firmware, r6900p firmware, r6900 firmware, r7000p firmware, r7000 firmware, r7100lg firmware, r7300 firmware, r7900 firmware, r8000 firmware, r8300 firmware, r8500 firmware, wgr614v10 firmware, wn2500rpv2 firmware, wndr3400v2 firmware, wndr3700v3 firmware, wndr4000 firmware, wndr4500 firmware, wndr4500v2 firmware, wnr1000 firmware, wnr1000v3 firmware, wnr3500l firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: October 9th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.