CVE-2015-8289 — Sensitive Information Exposure in Netgear D6000 Firmware

CWE-200 — Sensitive Information ExposureCWE-2553 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Netgear D6000 FirmwareNetgear D3600 Firmware
Timeline
PublishedJun 20
Latest updateMay 17

Description

The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-wjf7-67g7-7hmp: The password-recovery feature on NETGEAR D3600 devices with firmware 1↗2022-05-17
▶
CVEList
CVE-2015-8289: The password-recovery feature on NETGEAR D3600 devices with firmware 1↗2016-06-20
▶
CVE-2015-8289 — Sensitive Information Exposure | cvebase