Information Disclosure Vulnerability in NETGEAR XR1000 Router
CVE-2021-34870

6.5MEDIUM

Key Information:

Vendor
Netgear
Status
Xr1000
Vendor
CVE Published:
25 January 2022

Summary

The information disclosure vulnerability in NETGEAR XR1000 routers arises from improper handling of SOAP messages, allowing network-adjacent attackers to disclose sensitive information without requiring authentication. This flaw can lead to the exposure of stored credentials, paving the way for further attacks on the affected systems. Ensure to review your router settings and apply the latest security patches to mitigate risks.

Affected Version(s)

XR1000 1.0.0.52_1.0.38

References

https://www.zerodayinitiative.com/advisories/ZDI-21-1058/
x_refsource_MISC
https://kb.netgear.com/000063967/Security-Advisory-for-a-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anonymous
.