CVE-2017-5521
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
Description
CVE-2017-5521 is a sensitive information exposure vulnerability affecting multiple NETGEAR devices that allows attackers to disclose the administrator password through simple crafted requests to the web management server. The vulnerability enables unauthenticated password recovery by exploiting a flaw in the password recovery mechanism, granting full administrative access to the affected router or device. NETGEAR routers are ubiquitous in consumer and small business environments, making this vulnerability a significant threat to home and enterprise network security. CISA has added CVE-2017-5521 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.8% (99th percentile), exploitation is near-certain for exposed devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netgear | r6200 firmware | 1.0.1.56_1.0.43 |
| netgear | r6300 firmware | 1.0.2.78_1.0.58 |
| netgear | vegn2610 firmware | 1.0.0.36 |
| netgear | ac1450 firmware | 1.0.0.34_10.0.16 |
| netgear | wnr1000v3 firmware | 1.0.2.68_60.0.93 |
| netgear | wndr3700v3 firmware | 1.0.0.40_1.0.32 |
| netgear | wndr4000 firmware | 1.0.2.4_9.1.86 |
| netgear | wndr4500 firmware | 1.0.1.44_1.0.73 |
| netgear | d6400 firmware | 1.0.0.44 |
| netgear | d6220 firmware | 1.0.0.12 |
| netgear | d6300 firmware | 1.0.0.96 |
| netgear | d6300b firmware | 1.0.0.40 |
| netgear | dgn2200bv4 firmware | 1.0.0.68 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability(Vendor Advisory)
- http://www.securityfocus.com/bid/95457(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/41205/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5521(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2017-5521 exploits an exposure of sensitive information weakness in multiple NETGEAR devices, where the web management server inadvertently discloses the administrator password to unauthorized actors through the password recovery mechanism. Rather than implementing a secure password reset process, the affected devices respond to specially crafted HTTP requests with the current administrator credentials in cleartext, allowing any network-adjacent attacker to obtain full device access.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2017-5521 poses a critical risk to network security by exposing administrative credentials of NETGEAR devices. The vulnerability is exploitable from the local network without authentication, requiring no user interaction and minimal attack complexity. An attacker who obtains the administrator password gains complete control over the router, including the ability to modify DNS settings to redirect traffic, alter firewall rules to expose internal services, enable remote management for persistent access, intercept or modify network traffic, and use the device as a pivot point for attacks against internal network resources. With an EPSS score of 93.8% (99th percentile), this vulnerability is among the most likely to be exploited across all known CVEs. While not directly associated with ransomware, compromised network devices provide attackers with the network access necessary for deploying ransomware across connected systems.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-5521 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 29, 2022. The EPSS score of 93.8% (99th percentile) reflects near-certain exploitation activity, driven by the trivial nature of the exploit — a simple HTTP request to the web management interface is sufficient to extract the administrator password. Public exploit details and proof-of-concept code have been widely available since the initial disclosure, and the vulnerability has been incorporated into automated scanning and exploitation tools. No specific ransomware campaigns are currently associated with this CVE, but NETGEAR device compromises are frequently leveraged for botnet recruitment and network infiltration.
Remediation
- Apply NETGEAR firmware updates immediately: Per the CISA KEV required action, apply updates per vendor instructions as documented in NETGEAR Knowledge Base article 30632. If the affected device has entered end-of-life, it should be disconnected and replaced.
- Change the administrator password after patching: Even after applying the firmware update, change the router administrator password to a strong, unique password, as the previous password may have already been compromised through exploitation of this vulnerability.
- Disable remote management: Ensure that the web management interface is not accessible from the WAN (internet-facing) side of the router. Configure the device to allow management access only from trusted LAN segments.
- Enable HTTPS for management access: Where supported, configure the NETGEAR device to use HTTPS for the web management interface to prevent credential interception during legitimate administrative sessions.
- Monitor for unauthorized configuration changes: Review router configurations regularly for signs of tampering, such as modified DNS settings, altered firewall rules, or enabled remote management features that were previously disabled.
Technical Details
CVE-2017-5521 is a sensitive information disclosure vulnerability in the web management server of multiple NETGEAR devices. The flaw resides in the password recovery mechanism, which is intended to help administrators recover a forgotten password. However, the implementation fails to properly authenticate the requester before disclosing the password. By sending specifically crafted HTTP requests to the web management server — typically targeting recovery-related endpoints — an unauthenticated attacker can trigger the device to respond with the current administrator username and password in cleartext. The vulnerability does not require any prior knowledge of the credentials and can be exploited by any device on the same network segment that can reach the management interface. The trivial nature of the exploit, requiring only basic HTTP request crafting, contributes to the extremely high EPSS score of 93.8%.
Frequently Asked Questions
Is CVE-2017-5521 being actively exploited?
Yes. CISA has added CVE-2017-5521 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.8% (99th percentile) indicates near-certain exploitation for exposed devices. Public exploit code is widely available, making exploitation trivial.
What products are affected by CVE-2017-5521?
CVE-2017-5521 affects multiple NETGEAR device models. The complete list of affected products is documented in NETGEAR Knowledge Base article 30632. Many of these devices are consumer and small business routers, and some affected models may have reached end-of-life.
How do I fix CVE-2017-5521?
Apply the firmware updates documented in NETGEAR KB article 30632. After patching, change the administrator password immediately. For end-of-life devices that no longer receive updates, replace them with currently supported hardware. Disable remote management access as an interim mitigation.
How severe is CVE-2017-5521?
CVE-2017-5521 is a critical severity vulnerability that enables unauthenticated disclosure of the administrator password on NETGEAR devices. With an EPSS score of 93.8% (99th percentile), it is among the most likely to be exploited across all known CVEs. Complete device compromise is achievable with a single HTTP request, making immediate patching or device replacement essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.