CVE-2024-6646

MEDIUMNuclei

Netgear WN604 Web Interface downloadFile.php information disclosure

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6646 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /downloadFile.php of the component Web Interface. The manipulation of the argument file with the input config leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 10, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WN604

Browse Netgear / WN604

Default status: unknown

CVE List20240710affected
Before 20240710affected

Nuclei templates

1
ProjectDiscoveryMEDIUMNetgear-WN604 downloadFile.php - Information DisclosureCVSS 5.3

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be controlled. The attacker can initiate damage to the wireless network or further threaten it.

Impact

Unauthenticated attackers can download configuration files containing administrator account and password information, enabling complete router compromise.

Remediation

Update Netgear WN604 to the latest firmware version that addresses the information disclosure vulnerability in downloadFile.php.

WeaknessesCWE-200
Authorspussycat0x
Template tagscvecve2024netgearvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:h:netgear:wn604:*:*:*:*:*:*:*:*
FOFA: title=="Netgear"
https://github.com/wy876/POC/blob/main/Ncast%E9%AB%98%E6%B8%85%E6%99%BA%E8%83%BD%E5%BD%95%E6%92%AD%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md https://github.com/mikutool/vul/issues/1 https://vuldb.com/?ctiid.271052 https://vuldb.com/?id.271052 https://vuldb.com/?submit.367382

Source: ProjectDiscovery

References

5