CVE-2019-17373

Name of the Vulnerable Software and Affected Versions NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2

Description The issue allows unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg. This can be achieved by appending a specific string, such as ?x=1.jpg, to a URL.

Recommendations For NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2, consider restricting access to critical .cgi and .htm pages to prevent unauthenticated access. As a temporary workaround, avoid using URLs that can be manipulated by appending substrings ending with .jpg, such as ?x=1.jpg, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.