Vulnerability Description
The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netgear | D3600 Firmware | 1.0.0.49 |
| Netgear | D3600 | - |
| Netgear | D6000 Firmware | <= 1.0.0.49 |
| Netgear | D6000 | - |
Related Weaknesses (CWE)
References
- http://kb.netgear.com/app/answers/detail/a_id/30490Vendor Advisory
- http://www.kb.cert.org/vuls/id/778696Third Party AdvisoryUS Government Resource
- http://kb.netgear.com/app/answers/detail/a_id/30490Vendor Advisory
- http://www.kb.cert.org/vuls/id/778696Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2015-8289?
CVE-2015-8289 is a vulnerability with a CVSS score of 7.5 (HIGH). The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator passw...
How severe is CVE-2015-8289?
CVE-2015-8289 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-8289?
Check the references section above for vendor advisories and patch information. Affected products include: Netgear D3600 Firmware, Netgear D3600, Netgear D6000 Firmware, Netgear D6000.