CVE-2021-34870: NETGEAR XR1000 UPnP SOAPAction Missing Authentication Information Disclosure Vulnerability
First published: Tue Jan 25 2022(Updated: )
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NETGEAR XR1000 | =1.0.0.52_1.0.38 | |
| NETGEAR XR1000 | ||
| NETGEAR XR1000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this NETGEAR XR1000 vulnerability?
The vulnerability ID for this NETGEAR XR1000 vulnerability is CVE-2021-34870.
What is the severity of CVE-2021-34870?
CVE-2021-34870 has a severity rating of 6.5 (Medium).
How does CVE-2021-34870 affect NETGEAR XR1000 routers?
CVE-2021-34870 allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 routers.
Is authentication required to exploit CVE-2021-34870?
No, authentication is not required to exploit CVE-2021-34870.
How can I fix CVE-2021-34870?
To fix CVE-2021-34870, it is recommended to apply the necessary security updates or patches provided by NETGEAR.
- collector/nvd-index
- collector/zdi-advisory
- alias/ZDI-21-1058
- alias/ZDI-CAN-13325
- alias/CVE-2021-34870
- agent/references
- agent/title
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/tags
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- vendor/netgear
- canonical/netgear xr1000
- version/netgear xr1000/1.0.0.52_1.0.38