Vulnerability in NETGEAR Ac1200
CVE-2019-17137
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616.
EPSS: 0.027 (85.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H.
Affected products
- Netgear Ac1200 — versions R6220 Firmware version 1.1.0.86
- Netgear Ac1200_r6220
- Netgear Ac1200_r6220_firmware — versions 1.1.0.86
Weakness classification (CWE)
Public proof-of-concept exploits
References
- zdi-disclosures@trendmicro.com (VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-17137?
- CVE-2019-17137 is a critical-severity vulnerability in NETGEAR Ac1200, classified under CWE-626. CVSS score: 9.4/10. Published 2020-02-10.
- How severe is CVE-2019-17137?
- Critical severity. CVSS v3 base score is 9.4 out of 10.
- Is CVE-2019-17137 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.