CVE-2015-8289

The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.

Score

CVSS 3.0 7.5 High

Status

Modified - cret@cert.org

Published

2016-06-20

Last modified

2024-08-06

Weaknesses

CWE-200, CWE-255

Affected products

• D3600 Firmware (Netgear)
• D6000 Firmware (Netgear)

References

• http://kb.netgear.com/app/answers/detail/a_id/30490
• http://www.kb.cert.org/vuls/id/778696