Description
Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md
Scores
CVSS v3
9.8
EPSS
0.0093
EPSS Percentile
76.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (10)
netgear/dgn2200_firmware
netgear/dgn2200m_firmware
netgear/dgnd3700_firmware
netgear/mbr1515_firmware
netgear/mbr1516_firmware
netgear/wndr3300_firmware
netgear/wndr3400_firmware
netgear/wnr2000v2_firmware
netgear/wnr3500_firmware
netgear/wnr834bv2_firmware
Published
Oct 09, 2019
Tracked Since
Feb 18, 2026