CVE-2016-10175
🔴 Łataj teraz
Wyciek numeru seryjnego w routerze NETGEAR WNR2000v5 umożliwia uzyskanie danych administratora.
CVSS
9.8
EPSS
81.6%
Exploit
poc
Vendor
netgear
Opis źródłowy (NVD)
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 81.6% |
| Opublikowano (NVD) | 2017-01-30 04:59:00 UTC |
| Ostatnia modyfikacja (NVD) | 2026-05-13 00:24:29 UTC |
Referencje
- http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability (cve@mitre.org) [Patch, Vendor Advisory]
- http://seclists.org/fulldisclosure/2016/Dec/72 (cve@mitre.org) [Exploit, Third Party Advisory, VDB Entry]
- http://www.securityfocus.com/bid/95867 (cve@mitre.org) [Third Party Advisory, VDB Entry]
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt (cve@mitre.org) [Exploit, Technical Description, Third Party Advisory]
- https://www.exploit-db.com/exploits/40949/ (cve@mitre.org)