cbcvebase.
CVE-2016-5649
published 2018-07-24

CVE-2016-5649: A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17…

PriorityP276critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
27.21%
97.8th percentile
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.

Affected

4 ranges
VendorProductVersion rangeFixed in
netgeardgn2200——
netgeardgn2200_firmware——
netgeardgnd3700——
netgeardgnd3700_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/BSW_cxttongr.htm↗
path/absw_vfysucc.cgia↗
commandGET /BSW_cxttongr.htm HTTP/1.1
yara
regex: 'Success "([a-z]+)"'
  • →Unauthenticated GET request to /BSW_cxttongr.htm returns HTTP 200 with the string 'Smart Wizard Result ' in the body, indicating the admin password is exposed in cleartext. ↗
  • →The admin password appears in the response body matching the regex pattern 'Success "([a-z]+)"' — extract group 1 to recover the cleartext credential.
  • →After serving the password in cleartext, the page redirects to /absw_vfysucc.cgia — monitor for unauthenticated requests to /BSW_cxttongr.htm that are followed by access to /absw_vfysucc.cgia. ↗
  • →The PoC exploit uses a Googlebot User-Agent string to disguise the credential-harvesting request; alert on Googlebot UA strings targeting router management paths. ↗
  • ·Vulnerability affects DGN2200 firmware version 1.0.0.50_7.0.50 and DGND3700 firmware version 1.0.0.17_1.0.17 specifically; patched versions are DGN2200 1.0.0.52 and DGND3700 1.0.0.28. ↗
  • ·Shodan queries at time of PoC publication identified approximately 2,325 DGN2200 and 555 DGND3700 devices potentially exposed on the public internet. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.