CVE-2019-17137CWE-626

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart…

Critical · published February 10, 2020

CVSS v3.0
9.4
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

🚨 A sneaky null byte is the secret key here! This vulnerability in NETGEAR AC1200 R6220 Firmware lets attackers bypass authentication without breaking a sweat! 🔥 Think of it like a restaurant with a back door that anyone can walk through if they know the right trick. By inserting a clever little ingredient (the null byte) into the path, it opens the door wide and lets intruders skip the long line at the front! An attacker can waltz right into your router and access sensitive settings, potentially reshaping your network landscape! This means they could change configurations, intercept sensitive traffic, or even hijack your internet connection — absolutely devastating!

Put simply

Think of it like a restaurant with a back door that anyone can walk through if they know the right trick. By inserting a clever little ingredient (the null byte) into the path, it opens the door wide and lets intruders skip the long line at the front! This vulnerability allows attackers to bypass authentication checks in the NETGEAR AC1200 R6220 by exploiting how the firmware processes path strings with a null byte, leading to unauthorized access.

What to do

An attacker can waltz right into your router and access sensitive settings, potentially reshaping your network landscape! This means they could change configurations, intercept sensitive traffic, or even hijack your internet connection — absolutely devastating! Immediately patch your firmware to version 1.1.0.88 or later to close this hole. Additionally, consider changing default login credentials and monitoring your network for unusual activity to bolster security. You've got this! Follow these steps, and you'll restore security to your router in no time! 🛡️

The record
Technical detail
CVSS v3.0
9.4 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.02737 · 86.0th percentile
Weakness
CWE-626 · Null Byte Interaction Error (Poison Null Byte)
Published
2020-02-10T19:15Z
EPSS history
Timeline
  • 10 FEB 19:15Z
    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart…
    cvelistv5